Any password can be "cracked" if you do a bruteforce check on it and have enough time. The good thing with VB3 is the "scratches" system, which bans ppl for 15mins if they use the wrong password 5 times. This makes any bruteforce attempt a lot harder.
@ Natch: well, your post makes sense, but I somehow believe that a 7 char random generated password is harder to guess than a password made up by a user (as they tend to use real life words, which can easily be cracked with some sort of dictionary search)
Well, you can specify the amount of chars the password has to be so...everybody happy?