When I read about a password being secure and stating that it would take X amount of week, years, etc. isn't that referring to the worst case?
What happens if the brute force method is successul in much less time than the 'worst case'?
The recent event with LastPass where they noticed a lot of traffic leaving their server had thinking about this. Could someone have downloaded my LastPass data, which has all my usernames and passwords, and attempt a brute force crack on it to decrypt it? I have used a very long password to encrypt my data which should be difficult to crack, but what about in 5-10 years when we have much faster computer hardware. Could this be cracked at that point?