MySQL_Narb Posted July 25, 2012 Share Posted July 25, 2012 I have a system that will automatically deny anyone access to login for fifteen minutes after they have failed three login attempts. I'm curious to know if there's a better method of stopping bruteforcing without having to use this system which can be a pain to my users? Thanks. Quote Link to comment Share on other sites More sharing options...
xyph Posted July 25, 2012 Share Posted July 25, 2012 Yes, Limit it to 1 attempt/second or two. Enforce 8 character password. It makes no difference to the user, but if an attacker can only hit 1 password/second, it's theoretically impossible. You need to make sure you enforce the timer on the server-side. Don't use a session or cookies. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.