Brute forcing is so much more possible now-a-days due to GPUs, but Brute forcing SHOULD also be impossible because any site worth a shit should be locking out after 5 or so failed attempts (personally I think 10 is plenty, it gives you a couple attempts to realize "oh wait I'm typing the wrong password, not typing it wrong, then a couple more to figure out which password you used)
I hate those sites that lock you out in 3 to 5 tries. I have so many passwords I can never remember which one I used, so I have to poke each one in the likely order I used them. I think they should give you at least ten tries. Enough for someone who is forgetful like me, but way too few to break a password more complicated than a single digit number.