Online articles mention the importance of a strong password and suggest that hacking tools allows bad guys to attempt millions of passwords per second.  I am wondering why OSes and websites and such are not throttling attempts.  That is, if 3 bad attempts happen why wouldn't additional attempts be rejected for say at least the next 10 minutes?  Is there no low-level way of securely closing the floodgate of "millions of attempts per second"?