title: Preventing Brute Force Attack on MVC
body: <p>I am trying to figure out how to fight a brute force attack on my website.  Based on all the research I have done the top answers were Account Lockout &amp; Captcha.</p>
  
  <p>If I lock out a user then I am denying them service for x amount of time.  This means that if an attacker were to attack 10 different accounts he will lock them all.  Then when time is up he will lock them again.  Basically he can keep at it and keep the users locked out indefinitely.  The users can contact me but that is now 10 tickets I would have to deal with and I'd rather avoid that work if its possible.  So what I am failing to understand exactly is how is this then useful?  The attacker might not get into account but they will cause me and users a lot of grief.</p>
  
  <p>How do I combat this?  Ip banning seems pointless as it can be changed fairly easy.</p>