Locking the account that has had N unsuccessful login attempts (where N is configurable parameter) would be somewhat double-edged: someone would need to go and unlock the account (= extra work for the helpdesk). In addition, it could be abused to DoS the account of friend you don't like so much.
Having said that a softer alternatives are possible: locking out the account for short period of time: say 10 mins or implementing some throttling to reduce the number of attempts an adversary may take
Locking the account that has had N unsuccessful login attempts (where N is configurable parameter) would be somewhat double-edged: someone would need to go and unlock the account (= extra work for the helpdesk). In addition, it could be abused to DoS the account of friend you don't like so much.
Having said that a softer alternatives are possible: locking out the account for short period of time: say 10 mins or implementing some throttling to reduce the number of attempts an adversary may take