how to prevent brute forcing or getting unique detectable ID. (without cookie)

Hi,

 I have created manual login page and I am thinking implementing security check layer to preven brute forcing.

I have read a few articles including challenge method, and cookies.

While I was looking at them I thought* I might have a possible solution which is looking up on MAC Address but this is not possible without Active X.

 I thought Guid might work but you can only create* unique ID, but I realised that you cannot use this since it only creates unique ids which are not going to be detectable for later.

And obvioulsy you cannot do this by IP Address either.

What I really want to do is detecting the clients PC if possible and prevent brute forcing without using cookies.

If you gurus have any idea, please let me know.

Thanks for taking the time.

 Cheers.

 

 
...