Rate limiting login attempts for an email address or ip address is all well and good for protecting against brute force attacks, but when the attacker has the correct email and password combination already for the user, and access to massively distributed botnets, how do you block those logins?
Disclaimer: My company have been using Distil for a few months; mainly for detecting and blocking bots, but they provide a range of other security features.
https://resources.distilnetworks.com/customer-stories/accoun...
https://aws.amazon.com/about-aws/whats-new/2017/11/announcin...
It can also classify classes of users I.e. new portal users are moving mouse differently from users who are familiar with portal.
To add - by itself it’s not a reliable indicator of yes/no.
But rather another risk scoring input to overall identity detection system.
https://www.splunk.com/blog/2017/04/18/deep-learning-with-sp...
But every site still exposes it during the sign-up process ("You already have an account. Login here >"). Hiding it during the login flow is largely security theater leading to a poor user experience making people guess & check which email address they used for your service.
If you cannot do more advanced risk analysis: a) email the user after a few failed attempts, b) lock the account down for a period of time, c) lock that IP out from attempting any logins for a period of time, and most importantly, d) monitor lock outs. If an account is getting locked out frequently, be proactive and reach out. 99 out of 100 times it's the user struggling with things like your password requirements, but 1 out of 100 it might be an attacker.