I think it would work if you see it as a timing based attack that measures how fast the response comes back. This would explain both the "progress bar" as well

I think it would work if you see it as a timing based attack that measures how fast the response comes back. This would explain both the "progress bar" as well as the approx. constant time per digit.