> The main reason you need a strong password (assuming lock outs are in place) is because this kind of thing happens.
I think it is just the opposite.
If you assume that password databases get compromised every now and then, then obviously you shouldn't reuse the same password everywhere. Even a strong password could become public if some badly implemented service stores it in plain text.
And if you don't reuse passwords, then they don't need to be strong (i.e. resilient to an off-line attack where billions of possibilities can be tested per second). There is no point in keeping that password safe if the associated service has already been hacked to the point of losing their password database. Therefore, a password that can withstand online guessing attacks is sufficient.
Comments
> The main reason you need a strong password (assuming lock outs are in place) is because this kind of thing happens.
I think it is just the opposite.
If you assume that password databases get compromised every now and then, then obviously you shouldn't reuse the same password everywhere. Even a strong password could become public if some badly implemented service stores it in plain text.
And if you don't reuse passwords, then they don't need to be strong (i.e. resilient to an off-line attack where billions of possibilities can be tested per second). There is no point in keeping that password safe if the associated service has already been hacked to the point of losing their password database. Therefore, a password that can withstand online guessing attacks is sufficient.