Re: Account Lockouts

On Wed, 1 Dec 2004, Harrison Gladden wrote:
> What are successfull techniques that could be used on the web
> interface to avoid having a script run against it that would
> potentially lock out 15000 user accounts, and create a headache for
> the system administrators who have to manually unlock each account?

Why not throw a Captcha after X bad attempts ? And if you continue to see 
right Captcha word with bad password, then lock the account after Y 
attempts.

You could also think about blocking the IP address if you see too many bad 
login attempts from a specific IP address.

- Kalyan