Brute force password hacks involve repeatedly trying passwords based on a dictionary of often used passwords. Obviously if you use a password on this list you are going to be hacked quickly, but the problem mostly lies in a system that allows repeated failed attempts using random passwords until one succeeds.
People forget their passwords, I have about 6 in rotation with a few variations of each in use, and there are a few times where I might type in the wrong variant once or twice before I remember the one that I use for that account, however a system that allows a user to enter dozens, hundreds, or even thousands of failed passwords before hitting the right one, a reasonable and sane approach is to shut down the account and notify the owner that either they are a complete idiot, or that someone has hacked and found the correct password to access the account.
I can easily envision a password authentication service that looks at your trends and determines whether you are just slightly forgetful of what password to use, or if someone is obviously trying to hack into your account. If the passwords used are completely different on each failed attempt, then this is an obvious hack. If the IP's of the source of the failed attempt are random or in completely different regions of the planet then the last successful attempt, that is an obvious hack. One failed login every hour, day, week or even month suggests a low level brute force attack.
The idea that any hacker can try a bunch of passwords and break into someone's account is ludicrous today and represents either an ignorance or laziness about the authentication schemes used by the most popular cloud services.
Yes, obviously if your password is "password" or "123456" it won't take much to get in, but even slight variations of these passwords would involve having to make several failed attempts, and these should be painfully obvious for any well defined authentication service.
Ultimately, I think that services have to be less "forgiving" about failed login attempts even if it is from the legitimate account user. If it takes you 3, 4 , 5 failed attempts to login then you should be shut out and prove you are the legitimate owner of the account. I think too often authentication systems are set up assuming users are idiots that can't remember a password and must make dozens of failed attempts, but I think that has to change.
3 strikes you're out should be the ultimate rule for any authentication system, regardless of the amount of time between logins. If people are forced into painful account recovery methods they will better manage and remember their passwords. It's not 1980 anymore, passwords are not a burden, they are a reality of a secure cloud.
