jordanwb Posted September 5, 2008 Share Posted September 5, 2008 In my login script I'm trying to implement the feature that if there are X failed attempts, the user cannot try to login for Y period of time. Now I save the number of failed attempts and the time where login will be allowed in the SESSION superglobal. But I just realized that if the user clears their cookies, they can bypass this. Any ideas? I was thinking of storing their IP in a MySQL table, but with NAT you may be blocking someone who has valid data. Quote Link to comment https://forums.phpfreaks.com/topic/122803-solved-implementing-login-attempt-disabling/ Share on other sites More sharing options...
rarebit Posted September 5, 2008 Share Posted September 5, 2008 which account is somebody trying to access! ! ! Quote Link to comment https://forums.phpfreaks.com/topic/122803-solved-implementing-login-attempt-disabling/#findComment-634154 Share on other sites More sharing options...
genericnumber1 Posted September 5, 2008 Share Posted September 5, 2008 block them on a per-username basis... 5 or so incorrect passwords and you lock them out from that username for a certain amount of time. It solves the problem of dynamic/spoofed ips. Quote Link to comment https://forums.phpfreaks.com/topic/122803-solved-implementing-login-attempt-disabling/#findComment-634165 Share on other sites More sharing options...
jordanwb Posted September 5, 2008 Author Share Posted September 5, 2008 block them on a per-username basis... 5 or so incorrect passwords and you lock them out from that username for a certain amount of time. It solves the problem of dynamic/spoofed ips. Hey that's a good idea. I'll use that, thanks. [edit] Wait what about if the username doesn't exist? Quote Link to comment https://forums.phpfreaks.com/topic/122803-solved-implementing-login-attempt-disabling/#findComment-634166 Share on other sites More sharing options...
dezkit Posted September 5, 2008 Share Posted September 5, 2008 [edit] Wait what about if the username doesn't exist? IP ADDRESS Quote Link to comment https://forums.phpfreaks.com/topic/122803-solved-implementing-login-attempt-disabling/#findComment-634171 Share on other sites More sharing options...
jordanwb Posted September 5, 2008 Author Share Posted September 5, 2008 IP ADDRESS but with NAT you may be blocking someone who has valid data. You have no idea what NAT is do you? Quote Link to comment https://forums.phpfreaks.com/topic/122803-solved-implementing-login-attempt-disabling/#findComment-634177 Share on other sites More sharing options...
genericnumber1 Posted September 5, 2008 Share Posted September 5, 2008 If the username does not exist, still block them from trying to log into it. I'm assuming your goal is to stop brute forcing, and in doing that, it is a good idea to not treat non-existent usernames any differently than usernames that do exist. Quote Link to comment https://forums.phpfreaks.com/topic/122803-solved-implementing-login-attempt-disabling/#findComment-634213 Share on other sites More sharing options...
jordanwb Posted September 5, 2008 Author Share Posted September 5, 2008 it is a good idea to not treat non-existent usernames any differently than usernames that do exist. Good point. I think that would qualify as security by obsucrity. Thanks. Quote Link to comment https://forums.phpfreaks.com/topic/122803-solved-implementing-login-attempt-disabling/#findComment-634218 Share on other sites More sharing options...
jordanwb Posted September 5, 2008 Author Share Posted September 5, 2008 Wait blacklisting usernames isn't what I want to do. I want to temporarily lock an attacker from using any username - existing or not - that I know how to do. What the problem is is determining if a user who has just cleared their cookies is the person who was attempting a brute-force. Quote Link to comment https://forums.phpfreaks.com/topic/122803-solved-implementing-login-attempt-disabling/#findComment-634227 Share on other sites More sharing options...
genericnumber1 Posted September 5, 2008 Share Posted September 5, 2008 there's no way to block a person specifically (and reliably I should add) since they can always change/spoof their IP or delete their cookies (if they're even saving them). Quote Link to comment https://forums.phpfreaks.com/topic/122803-solved-implementing-login-attempt-disabling/#findComment-634235 Share on other sites More sharing options...
jordanwb Posted September 5, 2008 Author Share Posted September 5, 2008 Yeah that's true. I guess the effort to renew their IP or clear their cookies may discourage them from continuing. Quote Link to comment https://forums.phpfreaks.com/topic/122803-solved-implementing-login-attempt-disabling/#findComment-634237 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.