Quote from: davidonpda on February 01, 2011, 05:25:38 PM

Captcha is better than nothing. Do the ad ones and make a few pennies off the hackers.

Store a column on the table for failed attempts. If the count > 5 then require a captcha with the password. On a successful login, reset the count.

If the count say, gets over 50, lock the account for verification, or run a cron to reset it on a daily basis.

Another flag inside the account when they first login could show these hack attempts, something along the lines of "57 attempts to login to your account were done prior to this login from IP: " etc... TOR IP's of course won't be very helpful.

Last log in from IP can also be helpful if people pay attention to it and normally login from a similar address.

None of that makes it bullet proof, but it certainly makes it easier to quickly spot an issue. Needless to say, your password shouldn't be password for something that stores money in it.

You _never_ lock based on an accunt. You _lock_ based on an IP address the request came from.(Look into the account lockout denial of service attack)