For every user you'd have to know all usernames which could be brute forced guessed or gathered with some sort of crawler. It's definitely a great point you br

For every user you'd have to know all usernames which could be brute forced guessed or gathered with some sort of crawler. It's definitely a great point you bring up I think with web analytics an attacker has a natural advantage since captchas would obviously not be feasable. But it is worth to but effort in not making it too easy. > Happy lunch! Thanks :-) gonna start with my normal job now^^