The following is an article with good information on how to reduce the effectiveness of brute-force attacks against web applications. The technology relies on mathematical algorithms on the client that require more time to compute than to verify to incur a transaction cost for authentication against a web application to make it computationally infeasible to implement a large-scale attack.
http://www.infosecwriters.com/text_resources/pdf/AntiBruteForceResourceMetering.pdf