Sadly I mostly agree with this. File it with "the first time people get the password right tell them they failed, making them enter it a second time" and other janky but highly effective stuff.