What is the best method to prevent a brute force attack? [closed]

by

Sessions are unreliable because they rely on cookies, CAPTCHAs are regularly broken [including ReCAPTCHA]. The only reliable method is deceptively simple: ask a question. Don’t use a math question because computers are surprisingly adept at solving those for some reason. Great old standbys are things like:

  • What is the fourth word in the sixth paragraph on this page?
  • What is the name of the author of this site? [hint]

This is stupid-easy to implement, and very difficult for a machine to solve.

As for bute-forcing, try adding two fields to your user table, ‘first_failed_login’ [INTEGER unix timestamp or DATETIME] and ‘failed_login_count’. [INTEGER]

<?php
$bad_login_limit = 3;
$lockout_time = 600;

$first_failed_login, failed_login_count; // retrieve from DB

if(
    ($failed_login_count >= $bad_login_limit)
    &&
    (time() - $first_failed_login < $lockout_time)
) {
  echo "You are currently locked out.";
  exit; // or return, or whatever.
} else if( /* login is invalid */ ) {
  if( time() - $first_failed_login > $lockout_time ) {
    // first unsuccessful login since $lockout_time on the last one expired
    $first_failed_login = time(); // commit to DB
    $failed_login_count = 1; // commit to db
  } else {
    $failed_login_count++; // commit to db.
  }
  exit; // or return, or whatever.
} else {
  // user is not currently locked out, and the login is valid.
  // do stuff
}

This will make your login system recognize only 3 login attempts per user every 10 minutes.

More Related Contents:

  1. Limiting user login attempts in PHP [duplicate]
  2. Laravel – only a zero is saved to the database
  3. i need a PHP code to find longest contiguous sequence of characters in the string
  4. storing user_id in session variable
  5. Convert from MySQL datetime to another format with PHP
  6. Exploitable PHP functions
  7. New self vs. new static
  8. Call a REST API in PHP
  9. What is the best way to stop people hacking the PHP-based highscore table of a Flash game
  10. Passing an array to a query using a WHERE clause
  11. Seo Friendly URL results in CSS IMG and JS not working
  12. PHP Array to JSON Array using json_encode(); [duplicate]
  13. Accessing dates in PHP beyond 2038
  14. Show image using file_get_contents
  15. PHP – Upload utf-8 filename
  16. Upload video files via PHP and save them in appropriate folder and have a database entry
  17. get UTC time in PHP
  18. How do I immediately execute an anonymous function in PHP?
  19. PDO Connection Test
  20. Truncate float numbers with PHP
  21. How can I read a .tar.gz file with PHP?
  22. Why doesn’t file_get_contents work?
  23. Which is Faster and better, Switch Case or if else if?
  24. __construct() vs SameAsClassName() for constructor in PHP
  25. PHP function flags, how?
  26. MySQL get a random value between two values
  27. Execute raw SQL using Doctrine 2
  28. Redirect all traffic to index.php using mod_rewrite
  29. Sort by date (newest)
  30. CakePHP switch database (using same datasource) on the fly?

Leave a Comment