Cool! I'm impressed with the level of effort!

Well, at the very least, after this exchange on which I have been shown wrong on every point I have made (except the need to disallow user-supplied javascript), I now have plenty of ammunition to back up my future arguments about the ease of cracking passwords based on the wrong mechanism.

Thanks for going through the trouble to be rigorous on this.

hackmare.