Protecting against brute-force attacks