We've recently had a penetration test for one of our applications.
The Penetration Testing company identified that our application lacks protections against brute-force attacks on the login page.
We've been recommended to implement a captcha to disrupt brute-force attacks on the login page which I believe works well with the context and users of the application.
One of our engineers is insisting that we have enough protection against these attacks because we're using PBKDF2 as our hashing algorithm.
I understand that PBKDF2 slows down hashing computations and prevents offline cracking and in turn also slows down login brute-force attacks, but I fail to see how it removes the need for anti-automation prevention mechanisms? I don't see why we should even allow someone to try hundreds of thousands user/password combinations on the login page in the first place. It does not seem to address the identified problem.
The security company has provided a similar argument, but I'm having trouble convincing my Engineer colleague.
Question: Is using PBKDF2 good protection against brute-force attacks on web application login pages?