Password strength and online versus offline dictionary attack

My impression from reading around is that really strong passwords
aren't necessary if all one has to do is protect against online
dictionary or brute force attacks. (Assuming one has taken
precautions against such attacks like limiting the rate of attempted
logins, locking out accounts after too many failed logins, etc.)

What are the criteria for deciding that offline dictionary attacks are
not a threat? I would assume it's "if they can't get ahold of the
hashed password, there's no issue."

In my particular system, users connect to an apache website via SSL.
So I don't see how the hashed passwords could be sniffed, unless the
user computer is completely compromised (in which case all is lost
insofar as the intruder will know the plaintext username and password
anyway), or the server is compromised enough that the password hash
files are available (in which case, all is lost anyway from the server
standpoint as those files are highly protected).

I'm asking because I just went live with a production web-server/
database box, and the endusers aren't too happy with the random, hard-
to-memorize passwords I've handed them.

TIA

.

Relevant Pages

  • RE: VmWare and Pen-test Learning
    ... Setup a tftp server on your client machine. ... Use John the Ripper to crack the passwords. ... (dictionary attacks, brute force, single mode). ... Download FREE whitepaper on how a managed service can help ...
    (Pen-Test)
  • RE: Whitespace in passwords - now alt+xxx
    ... Subject: Whitespace in passwords ... 60 possible characters and the password is 7 characters long. ... >> Check your website for vulnerabilities to SQL injection, ... >> scripting and other web attacks before hackers do! ...
    (Pen-Test)
  • RE: policy-based password cracker
    ... that required at least one upper, one lower and one number in all passwords. ... password checks can be eliminated due to the policy. ... Since the vast majority of the time for a brute-force attack is ... most brute-force attacks are very fast. ...
    (Pen-Test)
  • RE: Rainbow Tables
    ... Subject: Rainbow Tables ... Fortunatly for this project we are only doing LM passwords, ... Audit your website security with Acunetix Web Vulnerability Scanner: ... Up to 75% of cyber attacks are launched on shopping carts, ...
    (Pen-Test)
  • pf vs null route
    ... My web server is always being attacked by people trying to guess our user's passwords. ... For a long time I have been using null routes for the persistent attacks. ... I do have pf running on several of our servers for other purposes and have been thinking about replacing the null routes with a blocking table using pf. ...
    (freebsd-questions)