|
On the sites where I require logins I don't lock accounts after any number of wrong passwords. Instead I lock the account for 15 seconds after any wrong password or attempt to login while the account is locked. That way the real owner isn't inconvenienced by their account being locked by someone else trying to break in and locking their account and any brute force attack will either fail completely if they don't guess right first go or if they do build in sufficient delay between attempts it will likely take many millions of years before they get to the right password (but I wouldn't expect them to build in such a delay which means that only their first guess is even considered).
|