It’s a combination of people being very bad at generating, remembering, and entering passwords plus generally being unwilling to wait minutes or even seconds to generate the hash on their local computer.
I mean, technically this is true, but it's also true if you have the ciphertext of the stored-password database, which is sort of LastPass's entire job. ;)
The only thing that might make it harder to brute force the master password with the latter than with a hashed password database is if the key derivation algorithm differs.
But I think your blanket statement is sort of misleading. In principle, if you trust someone with your encrypted password storage database, you should trust them with a hash of your master password; both serve as brute forcing oracles.
d9afca35a87a2af4168500640fcf2370
Password is 16 characters long, all lower case, no numbers, no special symbols.
Please tell me the password.
I use 64 character passwords, or if there is a length limit, always the longest possible. That’s the beauty of using a password manager :)
Aesop, my author, makes mention of two mice and they were sisters dear 1234567890123456789012345678901234567890123456789012345678901234567890
70 and little effort
Still a no-go for plain old brute forcing all a-z combinations. But, if your password is some combination of actual words, common keyboard sequences, or anything else in a password dictionary, it's cracked pretty quick/cheap.
https://stackoverflow.com/questions/10041298/how-to-recover-...
But can you show me the way how you'd go on about this? Really curious.