What I am trying to avoid here is brute force attacks on a user's password. And I am thinking about doing that by invalidating his password when too many attempts are made in the same minute, hour, day or something similar. The user credentials are for company employees on the road in an Android app.
But, at the same time, I do not want the user to make a few mistakes while inserting it and have it invalidated without any need.
How much is enough? Or, in alternative, how do I determine how much is enough?
Asking in another way, what is the maximum of mistakes a human can possibly do while inserting his password before contacting helpdesk?
Edit: The authentication mechanism is done through the network. The app gets updated information from a company server after the right user logs in.