> useless because scrypt(password,salt,work_factor) on the server is plenty hard to attack.

It enables DoS attacks, though, right?