I've seen bots try thousands of passwords for a single account on services that I've had access to the logs for. I can't name any instance when a password has been found by brute force rather than human engineering (or by bypassing authentication completely due to exploiting a software bug), and I've not seen it often, but there is code out there actively trying.
Tools like fail2ban help a little here, but can't do much against a large botnet. Adding artificial delays into the authentication process can slow down a brute-force attempt without inconveniencing real users at all, but that botnet has a lot of time on its hands. It might not happen often, but attempts are made often enough (i.e. more than never) for keeping strong passwords to be worthwhile.
Thanks, that is interesting and kind of matches my reasoning.
I have a feeling the debate is a bit colored by leftover paranoia from the times when several users shared one computer and the password database was easy to get hold of.
Unless the attacker somehow manages to grab your password database (and not your content, which would be an interesting setup in itself) he won't be able to brute force you. He will only be able to lucky-guess you. And you don't need 24 random characters to block a lucky guess scheme. :)
Tools like fail2ban help a little here, but can't do much against a large botnet. Adding artificial delays into the authentication process can slow down a brute-force attempt without inconveniencing real users at all, but that botnet has a lot of time on its hands. It might not happen often, but attempts are made often enough (i.e. more than never) for keeping strong passwords to be worthwhile.