Brute Force Login Passwords

Infinite-Chess / infinitechess.org

Infinite Chess Web Server

GNU Affero General Public License v3.0

0 stars 1 forks source link

Brute Force Login Passwords #2

Open Naviary2 opened 5 days ago

Naviary2 commented 5 days ago

After you click "Log In" to test if your username and password is correct, there is no delay until the server lets you try again. Issue this creates:

Hackers can attempt to brute force users passwords by spamming every single password.

Proposal

Add a 1-second delay between login attempts, on a per-user basis. But a new issue this could create is:

Hackers can attempt your password once a second to effectively lock you out of your account.

No other solutions thought of.

tsevasa commented 3 days ago

I would propose a 1-second delay cooldown per IP-address for a given user account, in order to address your concern. Still not perfect, but at least better than nothing.