In my tests, I observed the (default) policy prevented the bf run. For shorter (<=5) username / pass lists, it seemed to work fine. Hence, this is turned false.