[georgemcbay]

Even if the substring is random and unique to a user it'll still be easy for an attacker to guess which part of the password that is, just like it is usually obvious which of the recaptcha words are the known and which is the unknown.

eg: mysillypasssoqpword Yeah, I think I can guess what happened there.