I need help determining how safe the login is. First of all, I have been reading this:
It's really well written, great information most of which was either entirely new information or more detailed than I previously knew. However in my situation, I can't decide if it's helpful or not.
The problem is:
- I have a login that will be used by 1 - 3 people max, with their passwords distributed in advance. The login itself will be online, but will function more like a closed network login, not being available to the global public visiting the website with clickable links to it -> (but with modifying the address bar to add /admin so that admins can access it.
- With that being done, the user experience for even a handful of people is necessary. I want to put a dreadful "Remember Me" so that while only they will use the login to access the admin page, they don't have to login everytime.
- The problem arises when a real situation today is to someone accidentally charge to the login or admin page. Either way since he/she isn't logged in, the page will forward him/her to the login page. For the global population that really went there accidentally, I will put a "Return to Home" link, but the concern is if that person tries to brutal attack the way in, or worse.
- I thought about IP FILTERS but don't know how good that will be, today it's absolutely no effort to change an IP ADDRESS. I thought about Session lock with DB values on login, but that would lock the entire login for X amount of time (and if the brute force continues, the admins will never be able to login, because the lock will re-activate after the X time with the brutal attacks). I thought about captcha, but wouldn't that counter the remember me?
- I don't like to false hope that nobody will even try to hack an innocent website, or spam the hell out of it. That is reality today. I just want to hear if you have a better way than what I think. If so please, tell.