[spydum]

I’m pretty sure that would be unmanageable, but love to see it tried.. Are you thinking of each character acting more like a number in a combination lock and needing to be provided to the app sequentially to be checked? I dont get how you distinguish between password managers and bots or API dictionary attacks on the same interface?

[jarfil]

Isn't that essentially how the "I'm not a bot" captcha works though? And it seems to work pretty well.