the logic used above is flawed, because crackers know what words and strings are used most frequently. so that shortens the list down tremendously. secondly, just because the average is 9 does not mean you can not crack using every combination of 6 or shorter, where 6 is the usual minimum user/pass length at many sites.
not to say strongbox isnt a good solution, but their math is a bit off IMO.
|