It's not really a pitfall as much as it not being magic. It does the job it was designed to do. It can't magically make "password" a good password. I think the

It's not really a pitfall as much as it not being magic. It does the job it was designed to do. It can't magically make "password" a good password. I think the greatest strength here is large password databases -- if somebody nabs a million logins to Paypal or similar, then such measures slow down the speed at which accounts can be broken into, give time for the service provider to notice and react, makes it very unlikely for people with good passwords to be compromised, and probably completely protects nuts like myself that use fully random 16 character passwords. Yeah, some accounts will still be broken into, but it'll take more work and reduce the damage.