hmm, perhaps I'm missing something, but shouldn't systems just not allow you to attempt to login so much and so frequently? I guess these systems do get hammer

hmm, perhaps I'm missing something, but shouldn't systems just not allow you to attempt to login so much and so frequently? I guess these systems do get hammered by so many improper attempts and you'd risk blocking the actual account owner. But if a billion attempts are made from the same ip in an hour, shouldn't that be considered suspicious? Personally, I like what Google's doing with the two-step verification. That's probably where security should be going.