My boss asked me how I would improve the login strategy they have implemented at the moment: introduce user, password and resolve a .NET captcha from the first attempt.
An auditor security team said that our web applications may be vulnerable to brute force attacks, so I propose them to carry out the following strategy:
- Let the users introduce incorrectly user and password 3 times.
- After the third failed attempt, the captcha must be also resolved.
- After another 3 failed attemps, the user will be temporaly locked out at IP level (a few minutes).
I proposed that because it will also improve a little bit the usability. A big part of our users are elderly people, and it is annoying for them to resolve the captcha every time they want to log in.
So, my question is: will it be safer to show the captcha from the beginning? Some time ago, a lot of websites used to show it after n failed attemps, but now they prefer to make sure the user is not a robot every time he wants to be authenticated. Is there any reason to really do that?