Yes .. and yes!!!

Hi Ronald, 

Thank you for the suggestion. I will forward this to the development team for their consideration. 

I would think stating locked out is great but having the option to not stay time, etc. as I can see dumb hackers reading the screen and trying right after it expires.

Yeah, giving away your block times etc. doesnt seem like a great idea...

You generally got to be very careful of what info you relay back to the login page. Hackers could use any piece of information they see to validate their other data. If they know they are blocked, they can try with a different IP or try a different user in the mean time. If we keep telling them the exact same thing, they may not know they are blocked or that they are even hitting a valid email address. This can slow down serious attempts to bruteforce this information.

We just need to be able to modify that message, we set up a personalized message.