increasing time delay for login to stop bruteforci

Question

I have set up my db to log every failed login attempt. I thought I would multiply the number of failed attempts with 0.05 seconds or something. Something like:

            time_nanosleep(0, (50000000 * $failed_attempts ) ); 

More attempts a hacker uses to guess a password, more time does it take to check every time. After checking a 100 passords he must wait 5 sec between each try.

Is this a good way to stop bruteforcing? I identify the users by IP. So I guess you can bruteforce the application by using multiple proxy servers or something, but besides that, I think is a good idea. What do you guys think?

Answer 1

Limit retries by IP and use a CAPTCHA. Don't overload your server, think KISS.

Answer 2

Bots do not really care about your delay, whether it is exponential or logarithmic or anything. Any delay you use can be overcome by polling. So, do not think delay. Think about limiting the number of attempts and use Google reCAPTCHA. It uses public-private key encryption. Works for eliminating most bots and is harder to crack.