[mikeash]

That hardly helps at all. Now instead of knowing your exact password, your attacker knows that your password is one of these 10-20 entries, and it's easy to just try them all.

[rsl7]

Nobody has ever suggested this is a secure or ideal way to do it..

[mikeash]

My point is that it's not really even better.