But most sites will choke out brute forcing. And if they don't, I don't trust them to not lose the password in some other way. Also, a lot of sites aren't worth the effort. I wouldn't really care if I lost say, my Twitter or my Tumblr. But I would care if I lost my Paypal or my email address.