The point of /sbin/noreply is to put up a decent message telling the guy who logged in that the account is disabled and then return 1. Read the code and see for yourself. It's not more or less secure than /bin/false, it's just less annoying than logging in and getting kicked out again without an errormessage. That's what it's meant for. But if /sbin/nologin is not in /etc/shells you get the identical behaviour from using /bin/false.
# Han -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org