Why doesn't software automatically detect password-cracking attacks, and thwart them?
Suppose that someone tries a brute-force password-cracking attack on some program XYZ that requires password authentication.
My understanding is that such an attack would consist of iterating over the set of "all possible passwords", supplying each in turn to XYZ, until one of them works. For this strategy to have any probability of success, the attacker would have to be able to supply to XYZ very many candidate passwords per second. Therefore, it would be trivial to program XYZ to detect this pattern (that is, distinguish it from the case where a legitimate user mistypes the correct password a few times), and automatically escalate the authentication requirement for the next, say, 10 minutes.
The idea is that the owner of XYZ would be allowed to set two "passwords": a "level 1 password" (AKA "the password") that is relatively easy to remember and easy to type, but also relatively easy to crack by brute force, and a "level 2 password" (AKA "the passphrase") that could be extremely long, impossible to crack by brute force, but also very inconvenient for (legitimate) daily use.
Someone who knew the convenient-but-weak password would hardly ever need to use the uncrackable-but-inconvenient passphrase.
I'm sure there's some huge flaw in this scheme, otherwise passwords would not the headache to legitimate users that it is. What is the explanation?