[LawTalkingGuy]

And if they aren't using such a password library, what other errors are likely?

Timing attack on the character of the pw which failed?