Martin: Off the Record Messaging: A Tutorial

Right sorry, that was my assumption which I didn't really make clear. My father didn't teach us some brain-teasing 20 character "safe even if the passwords are hashed with plain MD5" password when we were kids. It was just good enough that it wouldn't be on anybody's first dozen things to try.

There's probably a better phrase than "brute force" for systems where you're up against human patience rather than some machine processing limit, but I don't know it.