I am currently working on the redesign of a login page. I have initially suggested that login be throttled whereby pauses (incremental - in number of seconds) are introduced between each failed login attempt. The idea is that this will allow us to avoid locking the account and give users time to think about reseting their password and also counter any brute force attacks.
The development team suggested that login throttling will not help in preventing brute force attacks but a temporary lockout will. the temporary lockout works in the same way except that pauses introduced are (incremental - in number of mins and hours) so i am a bit confused...below is an example of how IBM QuickFile allows login to be configured:
So I have a number of questions:
A- what is the difference between login throttling and temporary lockout? aren't they the same but use different configuration parameters?
B- what are interaction design implications that i need to consider when adopting a temporary lockout mechanism? Do i have to let the user know when they will be able to try again? perhaps using some form of visual indicator.
C- what are the most adapted timeframes for pauses between failed login attempts that will not frustrate the end user? This post on StackOverflow seems to suggest seconds rather than mins