Yeah but I bet the implementation brushes up against things that have been used to come to a conviction under CFAA. I'm no lawyer but it seems like a big liability to me.

Yeah. When setting a password on a service, most people are not knowingly authorizing that service to use their credentials to try to log in to other services...