We have a platform where users can sign up for free using their email addresses (they can also associate social media account). Other than the name, email and social account there no other personal information is held about the customer. There is a possibility that the user account may be compromised through brute force attack by bots. Please keep in mind that we also do not want to discourage legitimate user experience.
What are the best practices or case studies around the platform on
- How many attempts before locking out an account, and
- duration of account lockout (linear or exponential based on the number of further retries).
Out of scope: Strong password