I was thinking about limiting the number of password attempts per time interval by user -- not the total number of attempts at any user's password per interval.  Does that fix the DOS concern?<p>In the RockYou case, a botnet could try 32M * # allowed/day given that it had a user list.