Question:

I am not a security expert and I have what may be a naive question. If hackers routinely use brute-force password-cracking scripts to guess thousands of login PWs per minute, isn’t mitigating this a simple matter of changing settings in the OS so that each failed PW attempt incurs a 3-second time-out period before the next attempt can be made?

Solution:

depending on what kind of system you are working on you can logout a account after so many times.
But keep in mind that you alwas have system account that have to work or your machine wont function.

Password cracking is not only for a normal user account, but also for buildin account’s like administrators and system account. giving them a 3 second delay means that you will have to wait 3 seconds, if you do this in a compay network and every user have to wait 3 seconds everytime he or she does something that uses a password will have to waint than.

So yes your idea is good, but not in a big enviroment or when time out’s could mean system interuption.