You are right, it's just a weak secondary measure but it does not really make it any more complex for the developer while causing some headache to the attacker

You are right, it's just a weak secondary measure but it does not really make it any more complex for the developer while causing some headache to the attacker :) In any case, one can seed the hashes table with a couple billion random hashes, making the lookup slower for both parties. It would hurt the attacker more, given the nature of brute force.