I love this topic, it's the biggest PITA in security.
To start, lets sum this up into a single category. The goal of an attacker is to break passwords since this is what we commonly use. The term brute forcing a password stems from trying every conceivable possibility and there are two ways to do it, Online and Offline.
Online attacks are straight forward, in web applications you are typically attacking a login form. The most common prevention method is to set a threshold and lock the accounts being attacked forcing manual administration to look at it.
This attack happens when a system has been compromised and the attacker has access to a database or password file. The common security measures here are password hashing and salting. (Think Ashley Madison)
Dictionary Attacks are a form of brute forcing. They are performed by using rainbow tables, which are dictionary based words and combinations which are common. This reduces the scope of an attack, because humans are flawed and lazy. This attack has been very successful.
At this point you may be saying "I know this already, whats your point." Entropy is my point. Password effectiveness is all about randomness and the time it takes an attacker to guess a hashed password. Adding entropy as mitigation is why we have password policies like:
- Minimum 8 Characters
- Must contain an uppercase
- Must contain a lowercase
- must contain a number
- Must contain a special character.
All these rules are adding entropy to your passwords and by extension adding mitigation techniques.