i understand your point of view security vs. usability, i offer you implement static password lockout mechanism, which has become a de-facto standard for almost every website.
here explained really well so i don't need to type again:
Most of the password lockout mechanism
today are static, which means, they
lock a user out after a certain number
of incorrect password attempts. This
feature is implemented to prevent
brute force attempts against the login
functionality. Even though this
feature does what it’s supposed to, it
has its own shortcomings too. From a
security point of view, this feature
can be abused by a bad guy to lock
most or all of the users by writing a
script with all the possible
permutations and combinations for a
username (which are mostly alphabets,
if not alphanumerical), resulting in a
denial of service.
From usability
point of view, there is always a
debate as to the number of attempts to
be allowed before locking a user
account. Most websites allow 3
attempts while some (very few) allow 5
or sometimes 7.
Intellipass tries to bridge the gap
between the security and the usability
aspect of this feature. By storing
every login attempt of a user,
Intellipass can intelligently
understand user’s past behavior and
act accordingly. For ex. If a user
locks himself out every time, then
Intellipass will dynamically increase
the number of attempts from 3 to 5 or
from 5 to 7. On the other hand, if a
user logs in first or second time
every time he or she tried to login in
the past, but for some reason has
taken 3 attempts this time,
Intellipass will automatically reduce
the number of attempts from 7 to 5 or
5 to 3. The second component of
Intellipass is throwing in a random
captcha or insert a time delay between
the login attempts to prevent
automated attacks.
