Why doesn't software automatically detect password-cracking attacks, and thwart them?



Long version:

Suppose that someone tries a brute-force password-cracking attack on some program XYZ that requires password authentication.

My understanding is that such an attack would consist of iterating over the set of "all possible passwords", supplying each in turn to XYZ, until one of them works. For this strategy to have any probability of success, the attacker would have to be able to supply to XYZ very many candidate passwords per second.  Therefore, it would be trivial to program XYZ to detect this pattern (that is, distinguish it from the case where a legitimate user mistypes the correct password a few times), and automatically escalate the authentication requirement for the next, say, 10 minutes.

The idea is that the owner of XYZ would be allowed to set two "passwords": a "level 1 password" (AKA "the password") that is relatively easy to remember and easy to type, but also relatively easy to crack by brute force, and a "level 2 password" (AKA "the passphrase") that could be extremely long, impossible to crack by brute force, but also very inconvenient for (legitimate) daily use.

Someone who knew the convenient-but-weak password would hardly ever need to use the uncrackable-but-inconvenient passphrase.

I'm sure there's some huge flaw in this scheme, otherwise passwords would not the headache to legitimate users that it is. What is the explanation?

Reasonably often, they do.  Any reasonable system will lock you out if you make too many online attacks (or legitimate incorrect attempts) to access the account.  

The problem comes with offline attacks.  The server (or whatever you are authenticating too) has to have something to compare the password to.  This is typically either an encrypted value that can be decrypted with the password or a hash.  If this value is compromised, such as when an attacker gains access to the database of users, they can then try to run the hash or decryption on their own computer and bypass all the counts of how many times things have been tried.  They can also try guessing orders of magnitude faster since they are working locally and don't have to wait for a network.

With an offline attack, it is possible to try thousands if not millions of attacks a second and it suddenly becomes trivial to attack simple passwords within minutes, if not seconds.  There is no way to prevent the attack since we have no control over the system being used to check the password.  This is why it is important to change your password after a DB compromise is discovered.
