When talking about password security, a lot of discussion centers on the risk of a password being guessed in a brute-force attack. For websites where a user has registered an account, what are the possible vectors for a brute-force attack?
Entering username/password pairs into the website authentication fields directly is one, but is often mitigated by a timeout or lockout after failed attempts. Carrying out an attack on a stolen database of hashed passwords is another, but assumes the database has been compromised. How else could a brute-force password attack be carried out (assuming we're talking about website accounts, not Unix accounts, services, etc.)?