It wasn't the method of authentication that was the problem, it was that the stored credentials were inadequately protected against brute force attacks.