hmm I guess we are worried about a smart attacker, and we know those guys are really smart

You can't imply that these organizations would need to try and guess your passwords though. They have extensive profiles on everyone, "see" the entire internet traffic and can take the data from that password protected website at will.

Really? You think the NSA is more interested in your bank password than random criminals in [country over there]?