Logon forms are another whole issue. "Lock out the account" is just a DoS vector. People are quick to talk about systems that can defeat a captcha but if the brute force goes from 50 passwords/sec to one password/10 sec it's mission accomplished.

Can't you just put a 5 second "loading bar" delay instead of a captcha then i wonder?

If you do that on the server side, per account, it works. Small DoS risk, but it remains acceptable

If you do that on the server side, per account, it works. Small DoS risk, but it remains acceptable

Not easily: if it's enforced client side it may as well not exist, if it's enforced server side you just let anyone lock anyone else out of their account by running a constant brute force attack against their account (a DoS vuln). It also does nothing for attackers who try a giant list of accounts but only one or two passwords for each.

I worked on Google's system for solving this. It's a pretty sophisticated analysis that decides whether to demand CAPTCHAs or not based on a lot of factors. The CAPTCHA was needed (at that time) because it's the only way to slow down the attacker without bothering the real user, who won't be shown one.

> without bothering the real user, who won't be shown one.

bullshit

Lots of signals used to prevent people seeing captchas when their passwords were being attacked, but you never see it so never think about it.

Serverside of course, but i would think the loading bar can be per connection rather than be per account right? Like a connection is attempted, starting the loading bar, and then 5s later you only allow that connection to continue the load? I do non-web dev stuff so maybe i'm missing something but it sounds like should be easy enough.

What stops you dropping the connection the moment you realize you're being loading barred.

Presumably the point is that the user (or bot) wants to access the content, a connection would have to complete the load successfully to do what they came for. if they just drop it instantly then that's a bot turned away.

But you don't want to throw an arbitrary five second delay into login for every good user, they hate that sort of thing whereas the bot doesn't care.

would requiring a un/pw sent to an email address work￶?