I am making a website with the goal of blocking bots that are trying to login from different IP addresses constantly... while still allowing regular users to login via Tor.
One of the approaches to preventing distributed password cracking attempts is to place an exponentially-growing block on any IP address that submits more than 1 incorrect password attempt in a row.
For example... say IP address 1.2.3.4 is controlled by a botnet and submits a bad password at time 1.
When they submit a second bad password immediately afterward (still at time 1), that attempt will go through.
But they will not be able to submit a third password attempt until say 15 seconds have passed.
Upon a third bad password attempt, they will have to wait 60 seconds before trying again (from the same IP), etc.
If I implement something like this though, all of the Tor exit node IP addresses will become useless to regular users pretty quickly.
Curious if anyone has any suggestions on how to do this better?
I am playing around with requiring exponentially-growing SHA-256 proof of work calculations to be done for each offending IP address, but most mobile browsers will simply crash the tab before it finishes calculating it's proof of work once the required amount of work takes more than a few minutes to calculate for the average user.
