The questions to ask in these situations and about security policy: 1) Are you increasing user friction? 2) Have you significantly reduced the workload of the

The questions to ask in these situations and about security policy: 1) Are you increasing user friction? 2) Have you significantly reduced the workload of the attacker? If 1) is yes, then it should be a no-go. A certain baseline amount of user friction is necessary for security. However, any additional friction is going to result in overall worse security for the site. You want your users to be using properly implemented password vaults. Don't get in their way. If 2) is no, or "only in obscure circumstances," then it's a no-go. Cost-benefit doesn't work out. See 1)