There are tons of questions, answers, articles, papers, cartoons etc. on the subject of how to choose a password in such a way that it's difficult to guess or crack with a dictionary-based attack.
I don't understand why a system would allow me to try that kind of attack in the first place, so I'm wondering what it is that I am missing about that type of attack - or any other type of attack that entails trying gazillions of different passwords until one works.
Why would anyone want a system to allow hundreds or even millions of login attempts with the same username and different passwords in a relatively short amount of time? I appreciate to be given some slack if I can't remember my password or if I miss the right key when I type it, but I don't need - nor want - to be allowed to try and fail 100 times with the same username, and at full speed.
In other words, how difficult would it be to design a system such that after a failed login attempt the next one cannot take place before an amount of time is elapsed that is proportional to the number of failed logins for that username? I'm thinking tenths of seconds or something like one more second per each failed attempt, which would not impact a real user's attempts but in my understanding would severely limit the feasibility of dictionary attacks.
In general, except a few niches that I can imagine to exist, wouldn't it be relatively trivial and harmless for the vast majority of systems to make this kind of attacks unfeasible?