Originally Posted by Why

the logic used above is flawed, because crackers know what words and strings are used most frequently. so that shortens the list down tremendously. secondly, just because the average is 9 does not mean you can not crack using every combination of 6 or shorter, where 6 is the usual minimum user/pass length at many sites.

not to say strongbox isnt a good solution, but their math is a bit off IMO.