brute force protection captchas

[shawn_a]

Alternative is to lockout and send reset email with timed token link.

I am against time throttles, as it can allow dos attacks to ties up many threads on your web server.

We can implement host blocking but any hacker worth their salt will be using a proxy anonymizer.