I've been doing some research on hacking recently and I found some very interesting tutorials on brute force cracking. I have some questions to ask and I'll be using Facebook as an example.
Let's say that a man decides to crack the password of a single account. He downloads some Brute force program and sets it to try every single password combination with different IPs. The same IP would be used until the captcha comes up, then it will be replaced by a new one, so facebook would not be able to stop the attack by blocking the IP.
Maybe I'm just stupid (I'm not experienced in this stuff) but the only way I see that facebook can use to stop this attack is by locking the account itself (preventing anyone from logging in), but that's bad for business because it would prevent the owner itself from logging in. Does facebook actually do this for such attacks? I assume that a large website like facebook would receive these sort of attacks frequently from different crackers, and some of them may actually attack several accounts at the same time.
So what does facebook do to prevent this? Because I don't see anything it can do besides lock the account, which is not practical. It may take months or years but with this method the hacker will eventually be able to log in, would he not?