Originally Posted By: andy
If you think about it, it is kind of hard to do. At best you can throttle the number of attempts or lock the account after a few failed attempts.

They can't do the stuff that they do on the web UI, there is no way of popping up a "are you human" form after a few failed logins.

I don't think locking peoples' POP3/IMAP access after a bunch of failed logins from China would be received very well by the users.

You could have a whitelist of IPs driven from the web interface. 99% of the time the desired operation is "whitelist the IP address I'm currently HTTP-ing you from", and for the rest it could offer a list of recent denied connections.

Peter