His point is that the tradeoff isn't too bad: leak 8 bits, get pretty lights. Now for me, the pretty lights are basically nil because I don't see the improvement over just failing a login attempt, the way every other system in the world works. Also, the average password probably isn't very complicated (my guess is around 30 bits of entropy on average) which means every bit is precious. If you're going to ditch 8 of them, you better be getting some damn good usability improvements, which this thing doesn't give.