Comment 10 for bug 138654

It would be nice if you had some number of attempts (e.g. 3) with no delay, and then after that have a delay. (e.g. 2 seconds). This way, a brute force attack is still impossible, but the more common case of making a typo in the password isn't annoying.