Originally Posted by
serpens
It seems like another solution, which might be even easier than changing to a real password, would be to put a delay on a repeated entry of a PIN. For example, if I enter the wrong PIN, I can try again immediately. If I enter the wrong PIN a second time, there is a one second delay before I can try again. After the third time, it's 10 seconds, and so on. At least that would slow down the bots.
Won't work. The botnet doesn't have to crack a specific account. There are tens of thousands of computers (lets say: 10000) trying out tens of thousands of accounts (lets say: 10000), probably only doing one attempt at guessing the pin. With a probability of 1:10000 for guessing right, one account is bound to be compromised with each single run.
HTB.