Frankly, this technique is security theater and doesn't deserve mention. As you mentioned, it is a fairly weak defense against dictionary attacks, and it does n

Frankly, this technique is security theater and doesn't deserve mention. As you mentioned, it is a fairly weak defense against dictionary attacks, and it does nothing to prevent possibly the most common attack: users re-using passwords they've used on other sites, and those sites leaking passwords.