Throttling login attempts

Question

(This is in principal a language-agnostic question, though in my case I am using ASP.NET 3.5)

I am using the standard ASP.NET login control and would like to impleme

Answer 1

Jeff Atwood mentioned another approach: Rather than locking an account after a number of attempts, increase the time until another login attempt is allowed:

1st failed login    no delay
2nd failed login    2 sec delay
3rd failed login    4 sec delay
4th failed login    8 sec delay
5th failed login    16 sec delay

That would reduce the risk that this protection measure can be abused for denial of service attacks.

See http://www.codinghorror.com/blog/archives/001206.html