I'd hazard no, because 'at scale'.

You could mechanical turk puzzle them trivially, but the realistic threat model is tens of thousands of credentials, tried against high value login prompts.