search

SpiderOak / Encryptr

Encryptr is a zero-knowledge cloud-based password manager / e-wallet powered by Crypton
GNU General Public License v3.0
1.58k stars 138 forks source link

Failed Login Attempts Limit (Lock) #212

Open Z3120FX opened 8 years ago

Z3120FX commented 8 years ago

Lock the user’s account after a certain number of failed attempts (30 mins, 1 hour & so on).

If Encryptr doesn't have plan for this yet, i think it's a good idea to include this feature for added layer of protection/security.

Plus, "camera capture" on failed login attempts limit is a good addition.

shibacomputer commented 8 years ago

Agreed that Encryptr needs this. We’ll look into it for a 3.0 release.

Z3120FX commented 8 years ago

Thanks @helveticade. Yes it is a must feature. Great, this is a nice progress. Thanks!

Facsimiler commented 6 years ago

IMHO, this is the most serious issue with Encryptr right now. Given that users are encouraged to enter site URLs, usernames, passwords, credit card details, etc. and put them in a publicly accessible location, it seems crazy that anyone can make multiple attempts to gain access to such an account without any restriction or limitation, and without the owner of the account being notified.

Some form of 2FA/MFA (as outlined in issue #123) would go a long way to address this, but wouldn't remove the requirement to at least delay a potential intruder.