GetSimple Support Forum

I want to implement some brute force protection for our logins.

I was thinking we could add a captcha after x many failed logins.

This makes it alot easier to handle than doing throttling delays which can open you up to dos attacks. Also avoid us having to do account locking which also can be a dos against a user.

Anyone have experience with captchas ?

Guestbook, ARGuestbook, p01-contact, Pages Comments plugins use captchas.

Alternative is to lockout and send reset email with timed token link.

I am against time throttles, as it can allow dos attacks to ties up many threads on your web server.

We can implement host blocking but any hacker worth their salt will be using a proxy anonymizer.

Maybe e.g. waiting 2^n seconds to allow logging after the n-th failed attempt?

The wait ties up a thread, an attacker could tie up all 200 threads in a php wait.

I like this one:

http://www.josscrowcroft.com/projects/mo...ry-plugin/

But maybe that's not the info you want..

Well, I think CAPTCHAs suck and are fairly useless. Can we secure it some other way?

how so ?