That depends what problem you're trying to solve. I've seen web applications deal with someone throwing rockyou at hundreds of users on the logon form. This sor

That depends what problem you're trying to solve. I've seen web applications deal with someone throwing rockyou at hundreds of users on the logon form. This sort of large scale brute forcing was completely arrested by captcha, the workarounds just aren't worth it at the scale.