Sites are dumb if they allow brute force attacks. It's easy to allow only 3 attempts and then block further attempts for 5 minutes. Then a billion attempts would take over 3000 years!