Comment by roman_savchuk

I'm sorry if it's dumb question, but how could one perform dictionary attack without having access to the hash table? From the login page? Unlikely, it will lock itself after a few unsuccesful attempts. Yet article implies that if password is weak everything else doesn't matter.