The only caveat with this is that it makes the "# of password retries allowed" number kind of fuzzy. An attackers gets two or three tries behind the scenes for

The only caveat with this is that it makes the "# of password retries allowed" number kind of fuzzy. An attackers gets two or three tries behind the scenes for every one they try. Like if they figure you used your cat's name, they get to try "FLUFFY" and "fluffy" and possibly "Fluffy" all at once.