I've always thought that the best password security possible would be to always have the real password fail a few times. People who know their password will keep trying it, someone else will try a different one. It's a variation of not giving an error that tells what failed.