Protect against automated attacks

[g105b]

With correct Denial of Service protection, it is impossible to brute force authentication mechanisms other than password, so these three attacks are only applicable to passwords:

• Brute force - password validation should get slower for each failure, until some a turing test is required.
• Credential stuffing - Testing email addresses or passwords that are obtained from known breaches of other services.
• Password spraying - Testing a single weak password against a large number of different accounts.