We've just had a security review of a client's site and one main issue raised is that a brute force attack would reveal the password if the username was guessable (ie "admin").
Could a limit on the number of login attempts be a possible feature in the future? Failing that does are there any suggestions for how we could best protect against this sort of intrusion with the current version of Craft?
Thanks!