https://ma.tt/2013/04/passwords-and-brute-force/