After the hack of Mat Honan I studied my own laundry list of accounts I have at the numerous web sites I use. There is one fact that stands out:
Many of the websites severely restrict the size and character options of passwords.
Ironically, government and financial websites were the worst offenders. One government site restricted passwords to 6-8 alphanumeric characters. Some financial sites limited the size to 8 characters.
I am left with the following question:
How can I determine whether a website somehow protects against a brute force attack on my password? (assume I can't create an anonymous account)
Google reveals some indication that there exists applications and libraries to mount a probative attack of my own, I'd rather not risk drawing attention or causing denial of service. It seems like there ought to be a less disruptive way of determining whether a countermeasure is implemented.
Follow on to address early answers:
- I'm not asking about protecting a web site I control. I am merely a user of the websites in question.
- The financial and government accounts that I have are not easily created. And definitely can't be created anonymously. Attempting to brute-force an account I use (whether anonymous or not) jeopardizes its availability for my use.