That "Guess the password one char at a time" thing also occurs in real life when people forget to use constant time comparison functions.
Variable time until some threshold number of repeat failures occurs (e.g. 3). After this, manipulate the comparison time in such a manner that someone attempting to do this sort of attack would come up with a dummy password. If they come up with said dummy password, alert the user of an attempted attack.