I was thinking about password security and thought about a possible way to slow down brute force attacks.
The imaginary login process should simply decline passwords one or two times, even when they are right. While this is bad UX and has to be explained to the user, it weakens the chance to make easy passwords guessed by dictionary attacks etc. at least by the factor 2 or 3.
Are there any more downsides, beside the mentioned bad UX?
What do you think about positive impacts regarding
- Social Engineering
Stolen passwords wouldn't work on first try. Depending on attackers knowledge about the system, even successful stolen passwords could get marked as "not working".
To save UX, it could just pop on unknown devices.
Downsides: security through obscurity?
Luckily, I don't plan to implement this as a "feature", it's more about theoretically thoughts.