I need to limit login attempts.
One option is to count attempts by IP address and then block the IP. The disadvantage is that different users may have the same IP address. Another option is to limit by an account identifier (username or email) and then block the account (it can be activated manually by support). The only disadvantage I can think of is that malicious users can guess usernames and block them... But other than that, it feels more secure because malicious users can use different IPs, right?
What's the recommended way to do it?