How can I prevent brute force attacks?

Question

I am working on authentication and adding brute force protection. I do not know how I should move on.

Should I just make a flat block after 15 failed attempts for a specific IP address ... or should I bind it to the username? Should there be both a captcha threshold and an absolute cutoff?

Are there other patterns that I must follow?

Answer 1

If someone is really trying to use brute force, he may have a number of IP addresses to work with. What you could do was constantly increase the delay after each attempt and determine its username. CAPTCHAs can be beaten (to varying degrees), so set the captcha treshold to “slow things down” and then just block it for an hour.

Please note that coarse forcing of this method is incredibly stupid, so I’ll worry more about the attacker getting a copy of the passwords from the database using injection or something else.