Stop Password Guessing
Printed From: Web Wiz Forums
Category: Web Wiz Web App Support Forums
Forum Name: Web Wiz Forums Suggestions
Forum Description: Do you have any ideas for applications or content on Web Wiz? Then leave your suggestions here.
URL: https://forums.webwiz.net/forum_posts.asp?TID=6122
Printed Date: 29 March 2026 at 2:48am
Software Version: Web Wiz Forums 12.08 - https://www.webwizforums.com
Topic: Stop Password Guessing
Posted By: Bliss
Subject: Stop Password Guessing
Date Posted: 02 October 2003 at 2:20pm
|
To stop people from trying to guess passwords or to use password crackers, the forum should have a limit to how many times you enter your password, like PayPal does. If the user is the right user, then they can simply press the forgotten password button and retrieve their new password. The limit should be around five, and should not reset when you restart the computer, close the browser window, etc, but reset everyday instead. So how about it? ------------- Hehehe... |
Replies:
Posted By: Gullanian
Date Posted: 02 October 2003 at 2:30pm
| Or it could use a session to prevent the user trying to login again if they do it more than 5 times, I think this has been suggested before. |
Posted By: Bliss
Date Posted: 02 October 2003 at 2:39pm
|
I searched before I posted and didn't find anything similar, but of course I could have missed it. Even when I posted I was suprised no one had mentioned this before. To get this to be foolproof, I think it might need a new db field. Every time the login button is hit, the data in the field increases by 1, and when the login is successful, it's reset to 0. That way the admin can set how many tries the user gets. ------------- Hehehe... |
Posted By: Gullanian
Date Posted: 02 October 2003 at 3:18pm
| Ah yes but that way what if you hate someone else and login to there account 5 times a day on purpose to stop them coming on the site? |
Posted By: KCWebMonkey
Date Posted: 03 October 2003 at 2:10pm
well then, you prevent a certain IP address from logging in more that 5 times. there are always ways to make things work....
|
Posted By: fernan82
Date Posted: 03 October 2003 at 6:31pm
|
Yea and there's always ways to get around things.... if somebody uses two proxies and switch back and forth for every attempt could beat that security, unless you record every failed attempt's IP which might not be a good idea... ------------- FeRnAN http://www.danasoft.com/"> 
|
KCWebMonkey wrote:Posted By: KCWebMonkey
Date Posted: 03 October 2003 at 6:53pm
| Ok, how about after 5 failed attempts at a certain IP ( IP's are recorded on failed attempts), then the account must be re-activated via email. |
Posted By: Bliss
Date Posted: 03 October 2003 at 7:53pm
|
Yeah, but see, with my way, every successful login will set the counter to 0, so you can login as many times at you want if you know the right password. ------------- Hehehe... |
Posted By: fernan82
Date Posted: 03 October 2003 at 8:37pm
|
Yea, of course it can be done, my point is that I don't think it will be done on WWF cuz it basicly requires a new table on the database to record all the IPs with the user ID and the number of attempts, so since WWF is designed with MS Access in mind and I know how bruce is about this kind of thing I don't think it will be done... I can think of another way to do it with just one new text field on the Author table and store all the IPs an attempts on the same field like 192.168.1.1:1;192.168.1.2:2 so you store the IP before the : and the number of attempts after the : and separate them with ; then the field could be reseted on every successful login... It will be a good idea but I don't think it will be done tho... Also I think the security images (numbers) on the login is the best form of defense against that, it can still be done by hand but you know how long it would take to guess a password by hand?? I think it's almost impossible..... only think I would do to improve that feature is to change the images to something harder to read as it is not impossible for a bot to read those images... What I would like to know is how MSN Chat do their bans, cuz if you go to a chat room there and start breaking havoc and come back to the same room they'll put a ban on you that's impossible to get out of it exept by switching PCs..... They don't ban your IP or your username and they don't use cookies neither, but the do something to your PC and you won't be able to enter the room again unless you switch to a different PC or wait till the ban is over (24 hrs)... I think they use ActiveX for that and whatever they do is global for all users on the PC cuz even if you switch to another account it still won't work... ------------- FeRnAN http://www.danasoft.com/">
|
Posted By: fernan82
Date Posted: 03 October 2003 at 8:39pm
You're missing something..... If I attempt to log in 5 times to your account then you won't be able to login successfully to reset the counter to 0. ------------- FeRnAN http://www.danasoft.com/">
|
Posted By: Bliss
Date Posted: 03 October 2003 at 8:41pm
|
Oops. Yeah, that would be a problem. ------------- Hehehe... |
Posted By: wistex
Date Posted: 04 October 2003 at 12:26am
|
They may use an ActiveX control and put something in your Windows registry. ------------- http://www.wistex.com" rel="nofollow - WisTex Solutions http://www.caribbeanchoice.com/forums" rel="nofollow - CaribbeanChoice Forums |