I'd hazard no, because 'at scale'. You could mechanical turk puzzle them trivially, but the realistic threat model is tens of thousands of credentials, tried a

I'd hazard no, because 'at scale'. You could mechanical turk puzzle them trivially, but the realistic threat model is tens of thousands of credentials, tried against high value login prompts.