I am currently encountering a publically available interface; accessible at least via web form/webviews and some stateless protocol (presumably REST). In the past this form allowed you to view your booking history without an account, by entering your last name, a booking id and a shared secret derivable from the id with which you booked.
Due to legal changes this shared secret may not be used anymore. Thus the interface now only asks for name and id, which I deem open to guessing attacks. Due to legacy devices it is not possible to introduce new metadata that are required.
I know the OWASP recommendations for slowing down guessing attacks (Slow down online guessing attacks and also Blocking brute force attacks). However, all of these recommendations require an account system present.
Blocking based on IP does not help against modern, proxy-implementing, attack tools. Also it might block a lot of users hiding behind bulk IPs (cable, big companies...).
I thought of adapting the device id cookies. Normally you have the protection of an account system. Maybe it helps to slow down the creation of a device id cookie and then lock users based on this. This way every request of a blocked user would be a lot slower than just firing the form requests and repeated legit requests would be slow.
Are there any best practices for protecting anonymously usable web forms/services? I am quite familiar with mechanisms where an account system is present, but this is new to me.