title: Preventing Brute Force Logins on Websites
body: <p>As a response to the recent <a href="http://blog.wired.com/27bstroke6/2009/01/professed-twitt.html" rel="noreferrer">Twitter hijackings</a> and <a href="http://www.codinghorror.com/blog/archives/001206.html" rel="noreferrer">Jeff's post on Dictionary Attacks</a>, what is the best way to secure your website against brute force login attacks?</p>
  
  <p>Jeff's post suggests putting in an increasing delay for each attempted login, and a suggestion in the comments is to add a captcha after the 2nd failed attempt.</p>
  
  <p>Both these seem like good ideas, but how do you know what "attempt number" it is?  You can't rely on a session ID (because an attacker could change it each time) or an IP address (better, but vulnerable to botnets).  Simply logging it against the username could, using the delay method, lock out a legitimate user (or at least make the login process very slow for them).</p>
  
  <p>Thoughts? Suggestions?</p>