I know the reasoning behind not letting infinite password attempts - brute force attempts is not a meatspace weakness, but a problem with computer security - but where did they get the number three from?

Isn't denial of service a concern when implementing a lockout policy that is easily activated?

Is there any hard research showing an optimal number or range to choose before locking out an account that balances actual security threat with usability?  

Thinking it through, I don't see any measurable security difference between three attempts and 20 attempts with the password complexity generally in use today. 

(I know this skirts subjectivity, but I'm looking for measurement based opinions)

Recently, at the OWASP AppSec 2010 conference in Orange County, Bill Cheswick from AT&T talked at length about this issue.

In brief, there's insufficient research.

In long, here are some of his ideas for less painful account locking:


Don't count duplicate password attempts (they probably thought they mistyped it)
Make the password hint about the primary password, and don't have a (weak) secondary
Allow a trusted party to vouch for the user, so he can change his password.
Lock the account in increasing time increments
Remind the user of password rules.

