I am currently working on the redesign of a login page. I have initially suggested that login be throttled whereby pauses (incremental - in number of seconds) are introduced between each failed login attempt. The idea is that this will allow us to avoid locking the account and give users time to think about reseting their password and also counter any brute force attacks.
The development team suggested that login throttling will not help in preventing brute force attacks but a temporary lockout will. The temporary lockout works in the same way except that pauses introduced are (incremental - in number of mins and hours) so I am a bit confused...below is an example of how IBM QuickFile allows login to be configured:
So I have a number of questions:
Is a temporary lockout just another term for login throttling?
What is the difference between login throttling and temporary lockout? Are they the same but use different configuration parameters. for example 3-6-12 seconds vs 5 -10 - 20 mins ?
What are the interaction design implications that I need to consider when adopting a temporary lockout mechanism? Can I let the user know when they will be able to try again? Perhaps using some form of visual indicator?
What are the most adapted time-frames for pauses between failed login attempts that will not frustrate the end user? This post on stakoverflow seems to suggest seconds rather than mins
What impact does this have on Denial of Service?
A bit more to clarify! when a Login fails the "try again" button is disabled a for a duration of 3 sec after which it is enabled.The user attempts to login again and fails, the "try again" button becomes inactive for 6 sec.
The process is repeated for 5 consecutive attempts and error messages direct users to reset their password.At the 5th attempt users are presented with a password reset screen.
On the other hand users could attempt to login and have a specified number of attempts after which the account is "locked" for a period of time, say 5 mins this increases to 10 mins after another set of attempts.