def default_delay_function(account_attempt_count, ip_attempt_count):
    """
    We throttle based on how many times we have seen a request from a
    particular IP or username. This function will delay the third attempt on an
    account for five seconds, and double that delay on every additional
    failure, to a maximum of twenty-four hours. We do NOT delay based on IP.
    Popular opinion is that IP based throttling doesn't belong in the
    application layer.
    """
    if account_attempt_count < 3:
        return (0, 0)

    twentyfour_hours = 60 * 60 * 24
    account_delay = min(5 * 2 ** (account_attempt_count - 3), twentyfour_hours)

    return (account_delay, 0)