Support

That's correct. In principle. I have a slide in my security presentation which reads "Length matters". This is the case here. OK, before you think I am suggesting something dirty, Im talking about password length, not about body parts :)

By definition, the security of a web-accessible interface is only as secure as the password used. You can use a 64 characters long string consisting of a-z, 0-9 characters. That's 72 bits of randomness, giving 4.72 e21 combinations. This makes the fastest password breaker require about 2500 years to break it. However, since this is a web interface, the speed of the crack depends on the maximum requests per second the server can handle rather than the speed of the password breaker machine. In regular conditions (up to 10 requests per second) it would actually take 7500 billion years to break it. I would say that this quite secure, given that the age of planet Earth is just 4.5 billion years :)

So while in principle it is possible to brute force the password, it's not practically possible if a long enough password is used.

Yes, that's correct, the Professional edition comes with the akeeba-backup.php command line script which call the backup engine directly, without going through the web.