2

I have a requirement to show google reCaptcha on 2nd attempt on login screen.

But frankly speaking I consider it not the way to stop bots.

Because on server side I cannot tell whether this is the first or second login attempt unless the user chooses to send some kind of cookie along with the request so I can identify which number of login attempts he is trying - hence HTTP protocol is stateless in nature.

And I believe bots are not stupid to send some cookie that make the server figure out any information about them.

I heard about some sophisticated solutions like a js script to run on the login page load to generate some id and then to send this id to the server and make the server to check this id, but still an intelligent-enough bot can simulate all this actions. but this is not what I am asking about.

Any advice?

Improve this question
  • 1
    Research has shown that bots have now surpassed human capabilities at solving captchas, so the answer is no – wireghoul Jan 26 '17 at 4:05
3

Storing the number of failed logins in the session or in the cookie does not work. As you pointed out, the attacker can simply delete the cookie. A better way is to keep the number of failed login attempts on the server, corresponding to the user name or the IP address used. If someone enters the wrong credentials, you increment the counter for that IP address or for that username on the server. This way the client can not alter it.

Improve this answer
  • the attacker can (sure he will) change the username, or IP (through proxy) as well. – Muhammad Hewedy Jan 25 '17 at 19:23
  • 1
    @MuhammadHewedy the attacker can gain some new IPs through a proxy, but the amount is limited; most attackers are not in possession of large botnets and so blocking the IPs they can get does put some limits, they wouldn't be able to make millions of requests that way. The proof-of-work JS you seem to mention in the question does the same thing; an intelligent bot can simulate the actions and make hundreds of connections, but you can make so that it's impractical to make millions of requests and thus protect against brute forcing. – Peteris Jan 25 '17 at 20:26
1

Nothing will completely stop bots trying to log in, that is not the goal.

The goal is to limit the number of attempts those bots get to make to a level where it is unlikely they will guess correctly, even if the user picks a relatively weak password.

You obviously can't expect the bots to send you a cookie, so some other form of checking is needed, likely some combination of limits per IP address, limits per Username and limits for various sizes of IP block.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.