title: increasing time delay for login to stop bruteforcing, good idea?
body: <p>I have set up my db to log every failed login attempt. I thought I would multiply the number of failed attempts with 0.05 seconds or something. Something like:</p>
  
  <pre><code>            time_nanosleep(0, (50000000 * $failed_attempts ) ); 
  </code></pre>
  
  <p>More attempts a hacker uses to guess a password, more time does it take to check every time. After checking a 100 passords he must wait 5 sec between each try. </p>
  
  <p>Is this a good way to stop bruteforcing? I identify the users by IP. So I guess you can bruteforce the application by using multiple proxy servers or something, but besides that, I think is a good idea. What do you guys think?</p>