So we're trying to prevent brute-force attacks on our web server login page--currently we just do IP-based locking if x failed attempts from IP address Y occur over z time period. After a security review we realized that we might be locking out users sharing an IP, which the OWASP article on the subject confirmed is a legitimate issue. We are now considering changing the algorithm to restrict by username as well as IP address- is this a bad idea? I'm not terribly worried about an attacker on the same IP as the victim intentionally trying to lock out the victim's account, but perhaps that is easier than I realize?
psuedocode for new algorithm:
username = x ipAddress = y // if we're here, user has entered bad credentials if( tooManyAttempts( x, y ) ) lockAccount else ... end if def tooManyAttempts (username, ipAddress) attemptsPerTime = getAttempts ( username, ipAddress ) if( attemptsPerTime > attemptsAllowedPerTime ) return true else return false end if end def getAttempts ( aUsername, anIpAddress) query database for attempts records where value in column username equals aUsername AND value in column ipAddress equals anIpAddress return number of records end