This question already has an answer here:
AFAIK the recommended practice to mitigate brute force attacks is to lock an account down for, say, 15 min (perhaps escalating lockout time if the attack continues afterwards?) after, say, 5 failed login attempts.
I understand the reasoning (brute force mitigation) but there's still one thing that worries me. Namely, doesn't this make the site vulnerable to malicious account lockouts?
Less severe version: A petty troll doesn't like user X so they enter a trivially wrong password for account X 5 times in a row. Repeat after 15min.
More severe version: Full blown DOS attack, automated "brute force" attack against the webstite's recently active users solely for the purpose of triggering the lockout mechanism. Let's say the website has around 1000 logins per day; attack against users who logged in in the last week = at most 7000 accounts, far fewer actually, let's say only 3500; 5 login attempts = 17500 login attempts, I don't know but this seems definitely feasible, doesn't it? And that's already a quite popular site: for websites most vulnerable to such attacks (Internet forums?) these numbers may even be two orders of magnitude lesser!
I don't understand this practice. Doesn't it mitigate brute force password cracking attacks at the cost of opening up glaring vulnerabilities to DOS attacks?