content: Maybe I'm missing something, but doesn't the standard "fail 3 times and your account is locked" that is standard on ~99% of the services I use sort of quickly defeat the brute force method?  Also, when it comes to hacking, isn't social engineering far more effective?