You do. A lot of users don't consider automation when it comes to people hacking their account. I've heard "Nobody will ever guess it though" a few times during my career.
What attack vector is a password with high entropy protecting against? The only one I can think of is an unreported database leak. The attacker may be able to more easily reverse the password hash and use your account on that particular service, at least until the leak becomes discovered and the service does a full password reset.
While it would be ideal to defend against that attack, I think it's far more important to stress that users have a different password for every website. The real attack vector that we see every day is a DB leak from a poorly secured website, passwords cracked, and then reused on important services. That's where the problem lies, not in the user's password entropy.
Jeff isn't wrong here, he's just attacking a relatively unimportant problem.
I'm no security expert, but I start to wonder if the "practical" entropy of a given password is actually much higher than the theoretical entropy numbers people derive.
Serious question: when is the last time anyone has had an account compromised because of a weak password?
What is your definition of "weak"? I sometimes help my landlord fix their computer when they accumulate too much malware. One time I brought their tower home to do this and didn't get their Windows account password. Instead of calling them I decided to try a few things first, including their kids' names. Lo and behold, the second attempt was correct.
Brute forcing a weak password probably isn't what you have to worry about when it comes to targeted attacks against weak passwords, but social engineering is.
Come to think of it, I also had an old account with a very weak password that I hadn't used in years mysteriously hacked one day. The language settings were changed to Russian when I went to reset my password. The fact that no other account of mine appeared to be compromised and I hadn't used the site in years certainly suggests brute forcing.
Very many people. And not all systems stop them from doing so.
And database leaks happen all the time too...
Do you run any ssh or email servers? If so, your logs will tell you already. I've got bots brute forcing passwords on my blogs, that nobody even read, but did have account functionality, with email sending. People made the point of adapting their bots for different captcha schemes just so they could send some email.
There's a difference between random script kiddies and targeted attacks. People do all sorts of wacky things.
Weren't the celebrity iCloud account compromises due to Apple neglecting to rate-limit a certain authentication API endpoint, allowing the hacker to brute force passwords online?
Also, doesn't some of the current crop of IoT malware brute force device passwords as well (after trying the defaults)?
root ssh:notty 116.31.116.44 Fri Mar 10 22:27 - 22:27 (00:00)
root ssh:notty 116.31.116.44 Fri Mar 10 22:27 - 22:27 (00:00)
...
Login using the root account is disabled.