Online articles mention the importance of a strong password and suggest that hacking tools allows bad guys to attempt millions of passwords per second. I am wondering why OSes and websites and such are not throttling attempts. That is, if 3 bad attempts happen why wouldn't additional attempts be rejected for say at least the next 10 minutes? Is there no low-level way of securely closing the floodgate of "millions of attempts per second"?