Account Lockouts can be a bad idea
Imagine you have the user
bob, who has an account at your awesome service. Now Eve wants to be malicious, and lock Bob out of his account.
She sends an invalid login request, then another, then another, and repeats that process until she receives the message that the account
bob is locked for a while. Then she repeats this process again and again, until
bob is locked for all eternity.
Bob on the other hand would like to log into your awesome service, and gets a confusing error message that his account is locked. He contacts your support at your expense, and they inform him that there has been malicious activity (and helpfully advise him to scan his computer using anti-virus software). After Bob has wasted half an hour of his time, he attempts to log in again, only to find that Eve has still locked his account.
You might ask why on earth Eve would do that. The motive can be manifold:
- Blackmail (give me money to get your account back)
- for teh lulz
- Getting Bob to use Eve's even more awesome service instead
How to do it instead
What you really want to prevent is online brute-forcing through automated means. Instead of locking the account, consider using a CAPTCHA to verify a human on the other end of the connection. You could also slow-down responses to login attempts to several seconds. This way, Bob would only have to wait a few seconds instead of not being allowed to log in at all.
If you want to go really big and fancy, try to do some behaviour analysis. This will cost you big time, but it does prove to be a useful aid when trying to determine if a login attempt is potentially malicious or not.
What about non-existent accounts?
So far, I explained why account lockouts are a bad idea. But if you really really have to implement them (e.g. because of customer demand), then you should also "lock" non-existent accounts.