Is a captcha enough to enforce multiple failed login attempts?

Question

Before I go crazy and try to script a way to lock folks out of their accounts on multiple failed attempts, is a captcha ideal? I've seen several sites that do this, but wasn't sure how effective it would be. Granted, if a human is indeed trying to "hack" into someone else's account, I would think blocking access for a few minnutes would be much better than having them input some random obscure characters.

Answer 1

CAPTCHAs are a common solution. They're rarely ideal.

One suggestion: Offer x chances (say 3) at which point you lock the account and then require some sort of email validation to unlock.

Otherwise, I think giving 1 or 2 freebie chances is fine and then switching over to a CAPTCHA'd login is acceptable.

Answer 2

If you aren't having spambot problems, CAPTCHA's are rarely a good solution. They are just annoying. I agree with DA's email verification idea.