jaymc Posted June 20, 2008 Share Posted June 20, 2008 Im creating a feature on why website where as if a user enters the wrong password 5 times their account is locked for an hour, to prevent people trying 100's of passwords until they gain access, or a bot trying a dictionary attack All seemed well, although I've just thought, any of my members has the potential to lock someone elses account which in turn, stops the genuine member from loggin in I dont think there is a way around this.. maybe there is Is this just how it works, or is there a better way to stop people trying 100s of passwords to gain control of an account / bot doing a dictionary attack Cheers Quote Link to comment Share on other sites More sharing options...
MadTechie Posted June 20, 2008 Share Posted June 20, 2008 Maybe add a CAPTCHA to the password entry screen.. also log the IP and maybe stop that trying any login for an hour (yes i know thats not 100%) Quote Link to comment Share on other sites More sharing options...
Jabop Posted June 20, 2008 Share Posted June 20, 2008 Add a table with IP / time failed, or a time failed in the user table and check the login against their fail time. You could simply use sessions to store how many times they've failed the password. If you want more security, add a column in the db for it. If >1 hour, let them log back in again. Quote Link to comment Share on other sites More sharing options...
DarkerAngel Posted June 20, 2008 Share Posted June 20, 2008 Maybe add a CAPTCHA to the password entry screen.. also log the IP and maybe stop that trying any login for an hour (yes i know thats not 100%) Heh got to it before I could. But yeah a CAPTCHA would make it so auto attack systems wouldn't be able to get through. Or another thing, maybe have an email send to the attacked account (on a lock) saying that they must follow a link or be unable to login for the duration. Quote Link to comment Share on other sites More sharing options...
rhodesa Posted June 20, 2008 Share Posted June 20, 2008 Another thing you can do (if you have their email) is if the account is locked, give them a link to send an unlock link to the email address. Provide them with a unique URL to unlock their account, and then they can log in again. ...and then still keep the auto-unlock after an hour part.... Quote Link to comment Share on other sites More sharing options...
rhodesa Posted June 20, 2008 Share Posted June 20, 2008 p.s. - CAPTCHAS are a pain in the ass for the user...avoid them at all costs Quote Link to comment Share on other sites More sharing options...
Jabop Posted June 20, 2008 Share Posted June 20, 2008 p.s. - CAPTCHAS are a pain in the ass for the user...avoid them at all costs I disagree, if the site is used enough, it should be implemented~ Quote Link to comment Share on other sites More sharing options...
jaymc Posted June 20, 2008 Author Share Posted June 20, 2008 p.s. - CAPTCHAS are a pain in the ass for the user...avoid them at all costs Yes I know, I hate these dam script kiddies Thanks for tips guys I think session is a good one Maybe 5 failed attempts per IP Address too Quote Link to comment Share on other sites More sharing options...
jaymc Posted June 20, 2008 Author Share Posted June 20, 2008 p.s. - CAPTCHAS are a pain in the ass for the user...avoid them at all costs I disagree, if the site is used enough, it should be implemented~ Yeh true, I would love to avoid them at all costs, but avoiding them leaves you open to intrusion or DOS attacks I guess web standards of today must force implementation of captcha's this the script kiddy world of the internet has gone BOT mad Quote Link to comment Share on other sites More sharing options...
MadTechie Posted June 20, 2008 Share Posted June 20, 2008 Sessions won't work.. if the user deletes this cookies or jusr removes the PHPSESSION from the URL, thay can try again i think rhodesa's solution is best but of course more work.. Another thing you can do (if you have their email) is if the account is locked, give them a link to send an unlock link to the email address. Provide them with a unique URL to unlock their account, and then they can log in again. ...and then still keep the auto-unlock after an hour part.... Quote Link to comment Share on other sites More sharing options...
rhodesa Posted June 20, 2008 Share Posted June 20, 2008 p.s. - CAPTCHAS are a pain in the ass for the user...avoid them at all costs I disagree, if the site is used enough, it should be implemented~ ok...how about a compromise and making them use a CAPTCHA if they have failed to login a few times for that account? Quote Link to comment Share on other sites More sharing options...
MadTechie Posted June 20, 2008 Share Posted June 20, 2008 after 3rd failed attempt, CAPTCHAS are also required Quote Link to comment Share on other sites More sharing options...
Jabop Posted June 20, 2008 Share Posted June 20, 2008 I didn't say store the Locked var in the session, I was just saying you COULD store the FAIL COUNT in the sessions, assuming the user was oblivious. Then, when count reaches X, add the locked status to the database. And I also said, should you want more security, make a table for attempts, or add a col to the users table. Quote Link to comment Share on other sites More sharing options...
MadTechie Posted June 20, 2008 Share Posted June 20, 2008 wouldn't it be better to just update a field in the DB ! Quote Link to comment Share on other sites More sharing options...
Jabop Posted June 20, 2008 Share Posted June 20, 2008 wouldn't it be better to just update a field in the DB ! In my opinion, yes. Simplicity for the original poster, no. Quote Link to comment Share on other sites More sharing options...
jaymc Posted June 20, 2008 Author Share Posted June 20, 2008 wouldn't it be better to just update a field in the DB ! In my opinion, yes. Simplicity for the original poster, no. If I update it in the DB, that will lock every computer from logging into that account But if I base it on SESSIONS, it will lock the "attackers" computer out I guess a captcha after 3 attempts is a nice comprimise Thanks again Quote Link to comment Share on other sites More sharing options...
Jabop Posted June 20, 2008 Share Posted June 20, 2008 ^^ That is not true. Check the login against the IP/Locked status. Quote Link to comment Share on other sites More sharing options...
MadTechie Posted June 20, 2008 Share Posted June 20, 2008 But if I base it on SESSIONS, it will lock the "attackers" computer out Just to point this out.. Sessions will NOT lock the attackers computer Sessions won't work.. if the user deletes this cookies or jusr removes the PHPSESSION from the URL, thay can try again i think rhodesa's solution is best but of course more work.. Another thing you can do (if you have their email) is if the account is locked, give them a link to send an unlock link to the email address. Provide them with a unique URL to unlock their account, and then they can log in again. ...and then still keep the auto-unlock after an hour part.... Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.