I'm curios as to what the reasons are? How do you bruteforce a gmail account? Surely Google will not allow you millions of tries?
Break into a less-well-secured site, steal the password file, which may use something like md5. Brute force offline. Then, try that password and username on a more secure site like gmail.
Just don't do it. And tell all your friends.
I can't possibly be the fastest runner from this bear.
2. Use the first letter of each word in a phrase. Again, now it's easy to remember but not a dictionary word.
3. Find a way to customize the password for each site in such a way that you can remember the pattern. Use letters from the stock symbol, the dominant color, the domain name, or some other word you associate with that site. Boom - now your password is unique per site.
> "DON'T REUSE PASSWORDS EVER"
Really, what IS sensible is having sensitive sites with different passwords and "who cares" sites with simillar ones. As the author actally says in the end of the article.
Of course that's also too much work for the average user.
I think single sign-on systems with two factor authentication and other advanced security are a step in the right direction.
I'd like to know what the author really meant.
Since most of these systems are rate-limited per-account, instead of iterating over passwords for a given account, you can iterate over accounts for a given (common) password. This won't work for a targeted attack, but if you have thousands of valid email addresses, trying them all with e.g. "password" as the password will likely yield a few for which it works.