[edit]  My comment below has nothing to do with error messages.<p>Personally, I dream of the day when middle school kids laugh when a bank website doesn&#x27;t require 2 factor authentication and understand how a brute force attack works.<p>Any child understands if you allow someone to try thousands of door keys to enter your house, eventually one key will work.  Why hide that simple concept for computer logins?