Open georgeto opened 5 years ago
There would be the option to add an RecaptchaField.
I am strongly against reCAPTCHAs, especially for privacy reasons. Furthermore, CAPTCHAs are not necessary to solve this problem. @Georgeto's approach should suffice.
reCAPTCHA for an internal tool is out of the question.
Locking the account is also a terrible idea, as it allows DoS. There are better ways.
We should prevent brute-forcing of passwords by locking the affected account or/and the requester ip after a certain threshold of failed login attempts.