I contest that the password has always been a small part of the hacking process.
it is a hell of a lot easier to have the site itself try to hand you access to the account via their weak attempts to be user friendly to people who forget their passwords.
Seriously, what do they want to know before they're like "durf, ok here you go?"
some of them only require an email address. Getting your intended target's email address isn't hard. getting access to it tends to open up the world to all the other accounts.
Out of all of your accounts, your email is the most important, the end.
Every account you have on a forum, with a bank, on your porn sites, whatever it is you do online, generally will have your email address associated with it in some way.
Take hotmail, say you want to hack bob who lives across the street, his dog has been shitting on your lawn. You see him checking his mail, you know bob has kids, tell him you need his email address for a petition you're working on to have old cartoons brought back to public television to expose our children to classics instead of modern garbage, I dunno be creative.
he gives you
bob@hotmail.com
you wander on over to the site and whats this? all you need to change the password is his state/city/zip and the name of the city he was born in?
well you can guess all the major cities around where you live, and if that doesn't work, well next time he checks his mail you can just make casual conversation, Man, schools these days just don't cut it do they, why my school from 20 years ago back in Washington could kick the pants of these locals, where did you grow up? xyz response, "oh really, were you born there?" "Oh nooo I was born in wichita kansas"
/cinch
Your security questions are by far a bigger weakness than your password.
by far.
Thats why when someone asks me where I was born, my 1st dogs name, my mothers maiden name, casual conversation or not, they can just shut the fuck up.
I do tell people where I was born though so I just stopped answering that one online.