I think there is a fundamental error in this post. If there were targeted attack against a person sure, but IMHO this protects against simple brute force attac

I think there is a fundamental error in this post. If there were targeted attack against a person sure, but IMHO this protects against simple brute force attack on the login page where the script just cycles through logins, finds a valid login, and then cycles through common passwords. If the argument is that the attack scripts can also run against the registration page to correlate login, sure, but you've just made the life harder for the attacker.