Microsoft’s research team studied this extensively. They looked at what actually happens when you enforce complexity requirements. Users don’t create randomly generated passwords. They follow predictable patterns. Capital letter at the start. Numbers at the end. Exclamation point at the very end. The word “Password” appears in about eight percent of “complex” passwords. When you force rotation, users increment numbers. Summer2024 becomes Fall2024. Or they add exclamation points. Or they change a single character and call it done. The false sense of security is dangerous. IT departments see compliance numbers go up. Everyone is following the password policy. The auditors are happy. Meanwhile, actual security hasn’t improved at all.
Typically you want to do the lockout for a location, not the user, or you step up the auth level. 3 bad logins -> please mfa before trying again.
But yeah, letting an attacker do that at will is bad. I’m a fan of token bucket rate limiting with exponential back off. You get 10 attempts. A new attempt is added every second. An attempt while the bucket is empty makes that become two, then four and so on.
Most people never notice because a buffer of ten and a new attempt every second just never runs out. If you accidentally hold down enter you’re only blocked for a few moments. A dumb attacker quickly locks themselves out forever.
Good points, thanks. I wasn’t familiar with token bucket rate limiting.