Tag Info

New answers tagged

3

I upvoted Jeff's answer. Architecturally, you are better off creating some independent gate keeping functions that are tied to client address and which run when the client side login input screen is called. Keep this separate from your authentication routines. You can limit try rates or max tries before flagging the account in some fashion, and that does ...


8

You shouldn't mess with the algorithm like this. I can't think about what the impact of this method is but it does scream insecurity. At the very least, it would allow an attacker to move roughly 256 times as fast since CRC is a relatively simple math function and then of course faster on the database part. You're a few whiteboard coding exercises away from ...



Top 50 recent answers are included