Everyone is aware of the convention/need for strong passwords.  With the number of different kinds of clues people can use in their passwords, plus the various permutations of caps and digit-letter substitution, a hacker would need to make many attempts on average, in order to get the successful password.

This link:  Slowing down repeated password attacks
discusses some effort to discourage all that guessing, although it's not the same question I have:  Why hasn't it become the norm to interfere with repeated guesses?  An increasing backoff time after each wrong guess is one way, and others have been discussed.

I have seen very few attempts to inhibit such guessing on Linux systems, or any web-based authentication.  I have been locked out of one system when I got it wrong 3 times.

IT folks impose more and more constraints, like character count, letters, digits, caps, and exclusion of user name from password.  But that simply increases the number of needed attempts in a situation where the number is not really restricted.

I'd like to challenge your assumption that this isn't being done.

[warning: wild approximations to follow]

Remember that a successful brute-force attack will require millions or billions of guesses per second to do the crack in a reasonable amount of time (say, a couple hours to a month depending on the strength of your password). Even a rate-limit of 100 password attempts per second would increase the crack time from a month to hundreds of thousands of years. Maybe my standards are low, but that's good enough for me, and no human user legitimately trying to get into their account will ever notice it. Even better if the rate-limit was by IP rather than by username just to prevent some kinds of Denial-Of-Service attacks.

Also, I don't know which Linux distribution you're using, but on my Ubuntu and CentOS systems, when I mistype my password at either the GUI or terminal login screens, it locks for 1 second before re-prompting me.



Even if the server isn't actively rate-limiting login attempts (which they really should be), just the ping time by itself is enough to slow you down to millions of years. You'll probably DDOS the server before getting anywhere close to 1 billion guesses / second. The real money is in getting a copy of the hashed passwords database and feeding that into a GPU rig where billions of guesses per second are possible.

TL;DR: if you are going to put effort into hardening your login server, you'll get more bang for your buck by improving your password hashing, and making your database hard to steal than by implementing rate-limiting on your login screen.



UPDATE: Since this went viral, I'll pull in something from the comments: 

This logic only applies to login servers. For physical devices like phones or laptops, a "3 attempts and it locks" or a "10 attempts and the device wipes" type thing still makes sense because someone could shoulder-surf while you're typing your password, or see the smudge pattern on your screen, or know that a 4-digit PIN only has 10,000 combinations anyway, so the number of guesses they need to do is very very much smaller.
