I don't particularly want to implement Captcha on my login form for a website. But I've got a block mechanism already in place.
What's the best way to protect from Brute Force attacks?
Here's what I was thinking:
Implement a lockout, so after 30 failed logins I block the customer account. 30 is an arbitrary number, but I figure brute force attack isn't going to guess within 30, and any customer who tries 30 times is probably going to have to call in for a password reset anyway.
Or should I just ignore brute force, and maybe implement it at a firewall, is there a firewall that can detect and stop brute force attacks?
I would think option 2 is better because the brute force won't drain my server resources if the requests don't reach it.