Originally Posted by Blackcrow

Most of the passwords being stolen these days are from password sniffers - they have gotten really good at stealing user/pass combos. The password "guessing" programs are gone and have been replaced with password sniffers. From speaking to others the best thing to do is use SSL with sessions if you want to keep things locked down. Your employees weak password is more likely to get sniffed out than guessed.