Even if it doesn't solve the problem, seems like it would help.  In this case, a user would need to have a "very weak" password to be compromised.  "Somewhat weak" passwords would be fine.<p>Also, after 100 or so attempts to login, I would thinking locking the user out would be fine (at least in many systems).