I'd like to show a CAPTCHA to prevent brute forcing attempts, but I was thinking of showing it whenever a user fails for an invalid username/password combination after X attempts, regardless of whether that user exists in the database or not.
The thought was that if a user did exist, then all an attacker would have to do is record which username combinations (after X attempts) displayed CAPTCHA vs did not (and thus based upon that, I can get all of the e-mails out of the database).
So therefore I'd show the captcha after x attempts regardless.
now, to keep track of that, I guess I'd need a database table that literally saves whatever input the user typed in, but does that seem somewhat excessive?
that someone could try firstname.lastname@example.org in one country, and in another, etc, and then one person ruins it for everyone to see captcha.
I could also try it by email@example.com + IP address (so only if you tried X times with a bad username/password combo from your current IP that it would show the CAPTCHA).
Do you think I should store IP ADDRESS and use that as the basis of showing a CAPTCHA for an invalid username/password combo? Or should I simply stick to the text used universally for some period of time.