Comment by pistle

Can someone school me in why we don't just throttle login attempts (each fail extends time to next attempt exponentially) and put an attempt cap that requires password reset?