How to add safety to login page

Question

I am making a website where users need to log in to use all the functions. The login form is placed on the landing page, but the actual login goes through a second page, login.php. If a user types something wrong, the user is redirected to login.php. On login.php the login form appears again alongside an error message like "Wrong password/username combination".

I am trying to make the website as safe as possible from hackers, and my question is, would it make any sense if I put a captcha image on the login page that the user has to fill in for each login attempt, or will it be more annoying than useful?

Answer 1

Lockouts after a set number of failed logins creates a DoS condition, where an attacker can efficiently prevent anyone from logging in. You also need to account for low-hanging-fruit attacks, where one attacker tries the 3 weakest passwords on every single account.

You should create a system that increases the delay between allowed login attempts up to a certain limit. A common choice is 1 second after the first failure, 5 seconds after the second, 20 after the third, and 45 seconds for all subsequent attempts. This should be the case per-account and per-IP.

CAPTCHA images are generally useless, since you can pay people in the 3rd world miniscule amounts of money to solve them, or set up phishing attacks to get unsuspecting users to fill them out for you. Besides, users find them annoying and they're often not solvable even by humans.

I highly recommend checking out The Definitive Guide to Forms-Based Website Authentication for a detailed and thorough description of the security methods you should consider.

Answer 2

Some sites do captcha after a few attempts, which may be wise. You could also do lockouts.

If you want your site to be secure one things you will require is an SSL certificate as cheap as a few bucks from: Namecheap or Globe SSL. These will prevent your credentials from being sent over the internet as plaintext.

Also, make sure that your site is protected against SQL injection, cross domain scripting, session jacking, and that the secure flag is set on any cookies.

That would provide a basic secure site login.