In reply to Pat.

You haven't read what I wrote.

Having a strong password will not stop a DDOS attack. Having every password in every WordPress installation in the world be strong will stop this type of DDOS attack. If the attackers can't brute force the passwords, then there is no point in trying.

They're specifically targeting WordPress due to weak passwords. If the passwords are strong, the problem goes away.

The only catch to this, is that it will take a very long time for passwords to be upgraded (unless it was forced on the users).