I think that one of the reasons it is not implemented is because it is a problem that isn't purely technical in nature. So you want to lock people's accounts to prevent brute forcing? There are still a bunch of decisions (both business and technical) before you can move forward.

  1. User support.  How willing are you to deal with increased need for customer support when they start locking themselves out of their accounts after a dozen failed attempts?
  2. How do you keep track of the number of failed attempts?  Another column in your database?  I don't run any big websites, but it seems to me that if an attacker can cause a write to your DB for every POST he can throw at you, your website performance will suffer.
  3. If it takes a dozen (or a hundred (or a thousand)) failed logins to lock an account, it would be trivial for an attacker to lock users out of their accounts, DOSing your site in a different way.
  4. Ok, so we block IP addresses instead of accounts?  Now we have to deal with issues of shared or easily changed IP addresses (or botnets that can afford to have hundreds of thousands of IPs blacklisted from a site and still keep brute forcing).

A lot of these issues are surmountable, but not until you do some basic threat modeling to decide what you want to protect against.

Maybe you decide to focus on preventing from attackers coming from one IP from slamming your site, so you keep an in-memory table of number of recent failed logins and perform temporary bans. It wont protect against botnets, but hopefully you are paying attention to what is happening on your site, and can make changes if that becomes an issue.

> yet most password security guidelines still warn against what they consider brute-forceable passwords.

Your password should be hard to brute force, regardless of whether or not the site protects itself from brute forced logins. The other big danger is that someone hacks the site and gets a dump of password hashes. Then, it doesn't matter what anti-brute force techniques the website is using if the attacker can perform an offline brute force attack against your hashes.

Instead of freezing the account until it's unlocked by customer service, why not just lock it for increasingly longer periods of time? 2 seconds after the third failed attempt, 3 after the fourth, 5 after the sixth, 10 after the seventh, etc.

Not too inconvenient for legitimate users trying to remember their passwords, but it surely makes bruteforcing impossible (if by the 1,000th attempt they're having to wait an hour between attempts).

That would still enable someone to DOS your website. A better way IMHO is to limit the maximum timeout - say 1 or 10 seconds. This, compared with even simple passwords that have slighlty more than 1 000 000 combinations, would mean hackers need days or weeks to crack passwords, in this time you should be able to notice the attack.

You would only be able to DOS a individual accounts, rather than the whole website. Do it by IP address, sure at some point someone with a huge enough botnet will be able to crack an account. But is it likely that someone will use their entire botnet to crack a single user's password on some consumer service?

Depends on what you can do on that site. Around my part of the world:

* Phone/number that is redirecting a call pays for the redirected leg of the call

This leads to a lot of creative hacking on trying to program a phone to redirect calls to expensive service numbers or foreign numbers. And many operators lets you administer call redirection on their website

An alternative might be for the user to be able to request that the block is cleared, and for that process to send out an automated email; if the user clicks the link in the email, the block is cleared.

It's no less secure than a password reset and would mean that legitimate account owners can't be locked out of their accounts by attackers.

This. Instead of having a timeout after n-number of passwords, have a random timeout after each one (between 1 and 3 seconds). Not really a big deal for a user (you can hold the connection open, so the browser looks like it's waiting for a response, or put up a loading spinner) but makes brute forcing infeasible.

Because the people who implement the login systems aren't always security professionals. Sometimes they're random, mediocre, software engineers who don't really care about security, but their boss put them in charge of the website.

And the boss isn't a security professional (or even a software engineer, half the time) so he doesn't care. In fact, there's commonly an entire culture all the way up the ladder where nobody gives a shit about security, so terrible holes stay wide open for years.

This is where the Anonymouses of the world are doing a real service for the world. People need to forced by real consequences to take security seriously.

There's not anything wrong with that either. As humans, we have limited available attention. You and I might argue that security is critical, but even thinking about everything that is reasonably deemed critical is paralyzing. Statistically organizations are just not going to take security seriously on the whole until they get pwned to the tune of billions.

I can't think of an example i've seen where Anonymous-like breaches caused anyone but the actually breached companies to reflect on their security (Sony didn't even react immediately, they got pwnd three times). Releasing personal information just isn't a threat to companies in the era of Facebook.

How would such an example be visible to you?

Does it really matter that they are/are not security professionals? Virgin Mobile is a major corporation, and (if I understand the vulnerability correctly) are willing to let a unique IP ping their server 1MM times in a day. Rate limiting software is open-source and easy to come by. How does Virgin mobile prevent DDOS attacks if this vulnerability exists?

Just because they're a major corporation doesn't mean anyone with any clout gives a shit about whether or not customer logins are being brute forced, or if their servers can be DDOS'd. Even if somebody cared to mention it, somebody else would mention that it's too expensive, they're not getting attacked right now, and there's more important problems to worry about, so it gets ignored. This is not just cynicism on my part - this is how most companies operate. When they start losing money they'll start caring about security.

Oh, and DDOS has nothing to do with rate limiting. If you fill up a pipe with incoming packets it's going to become unresponsive. There's no real way to stop it, but multi-homing, global distribution and some tricks administered by DDOS mitigation companies can help.

Automatically freezing an account makes it easy for an attacker to denial-of-service an account. Just try to login as many times as it takes to freeze the account, and then it's not available anymore to the legitimate user.

Simple answer:

The greater the restrictions on the account lockout policy, the more personnel you need to hire (salary, health benefits, pension, 401k) to deal with people who manage to lock their accounts out.

Or just outsource it to the lowest bidder, or better yet an automated system.

But how much does it cost them when these problems arise?

Pick a random PIN - say, 197326 - and try it against a lot of account (phone) numbers. Skirt IP-restrictions by renting a botnet for 15 minutes.