> If your site is vulnerable to a 'timed attack' then something else
> is wrong?
It's a valid point: a site that locks out accounts after just a few
failures is not vulnerable to an attack that requires a considerable
volume of trials against the same account.
However, even though account lockout policies are common on internal
networks (where intruders may be physically tracked) not everyone with
a public website can be so punitive. You are basically publishing a
DoS recipe if your site works this way. In addition, accounts that are
whitelisted from being locked out (if any) are usually the most
sensitive ones.
Yet I acknowledge that some high-profile web apps (LogMeIn comes to
mind) do have quick lockout policies. Nevertheless, you should not use
rapid account lockouts to combat timing attacks if other measures
exist. Security measures should not be so interlocked or accidental.
-- Sandy