[squeaky-clean]

I'm no security expert, but this would let someone try two unrelated passwords at once and so probably wouldn't be done client-side.

[iso1210]

In practice is there really any difference between allowing a client to try 10 passwords before 'lock out' (say no more attempts for 10 minutes), or try 5 passwords before hand.

[the_gipsy]

Ouch, you are right.