113 reputation
2
bio website
location
age
visits member for 2 years, 2 months
seen Sep 8 '12 at 21:45

Sep
5
comment Safe User Login Questions
So now that we are on the same page - you said that I can link 404 to users that haven't logged in and that way hide the login. This sounds great, but the admins too are normal guests until they log in. Like a normal guest the admin will 'intentionally' type /admin in the address bar and go to the login page, but the system will redirect it back to home page. So the 404 is the best solution, but if I make it, I will lock the system from any login
Sep
5
comment Safe User Login Questions
I don't know if are on the same page but - the website doesn't have any logins for normal guest users. The main login is also not available to them. The only threat guest user can attempt is the search. And that is protected from SQL injection. So I don't know how will those DoS users find out the username of the admin, or even find the login, especially if its hidden with the 404. Once again, I fail to understand.
Sep
5
comment Safe User Login Questions
I am not getting it, obviously - explain the DoS threat. They don't need the login to spam the server yes, but they won't atleast spam with login requests. Or that's not the logic?
Sep
5
awarded  Scholar
Sep
5
accepted Safe User Login Questions
Sep
5
comment Safe User Login Questions
Thanks a lot. I've be re-reading what you said like 5 times. 1. Right 2. Got it, random token 3. That is a great idea. I think a simple if/else will suffice 4. Right, even 20 characters would take years to crack, for 40+ its veerry long. But the DoS is a considerable threat. Will the 404 work against DoS, if they can't get to the login page? Yea, its for the worst type of users, but certificates won't do because all of them have home/work computers + phone with internet.
Sep
5
awarded  Student
Sep
3
asked Safe User Login Questions