It's actually AFTER the 5th minute you'll be blocked.

Say I use:

SOGoMaximumFailedLoginCount = 2;
SOGoMaximumFailedLoginInterval = 10;

I do a failed attempt at second 0. One more at second 1 and one more and second 2.

The fail count will be 3. But we check this:

  if ([[failedCount objectForKey: @"FailedCount"] intValue] >= [dd maximumFailedLoginCount] &&
      delta >= [dd maximumFailedLoginInterval] &&
      delta <= block_time )

delta would be equal to 2 ( current_time - start_time );

If I try at second 12th, I'll get blocked because delta >= 12 and the fail count > 2.

This hasn't changed since June 6th 2013 - so more than a year ago.

Hmmm..., my preceding tests were not accurate then.

In my opinion it should block immediately after surpassing the maximumFailedLoginCount within the maximumFailedLoginInterval.

Else you could use the maximumFailedLoginInterval for unlimited password brute force cracking attempts.

Any news?