A web vulnerability scanner on my website made a suggestion that I implement an account lockout mechanism for my site when there has been a certain number of invalid login attempts. I am trying to wrap my head around this to make sure I do it correctly.
This is what I have decided to do. First, in the event of an invalid login attempt the initial error message is that either the username or password was incorrect.
Next, if the username was correct for successive attempts, but the password incorrect, I will begin a counter that will lock the account after x number of tries. I won't display the counter right away, maybe not until there are two tries remaining. This way a user won't get nervous if they simply made a spelling error on their first attempt.
If a user does proceed to lock the account, it can be unlocked by further entering the correct credentials plus answering a security question. If they still do not know the password, they can initiate password recovery through email.
My problem arises when deciding what to do when there have been successive invalid attempts where the username is incorrect. Since the username is incorrect, there is no account to lock. I have read suggestions to lock the login script internally and introduce a throttle to slow down any would be crackers, but just continue to display the standard error message that the username or password is incorrect. The only problem I have with this suggestion is that once somebody figures out how the lockout works they can gain a clue as to whether they are inputting a valid username or not, by seeing a counter after successive failures they will know they have a valid username, no counter = not a valid username.
Anybody have thoughts on this they can share?
EDIT I agree that some legitimate users could get caught in this lock out process. I think that my use of the phrase "would be crackers" takes into account that not everybody who forgets their username/password is indeed a cracker.
