I am making a website where users need to log in to use all the functions. The login form is placed on the landing page, but the actual login goes through a second page, login.php. If a user types something wrong, the user is redirected to login.php. On login.php the login form appears again alongside an error message like "Wrong password/username combination".

I am trying to make the website as safe as possible from hackers, and my question is, would it make any sense if I put a captcha image on the login page that the user has to fill in for each login attempt, or will it be more annoying than useful?

  • 5
    This has been covered in tons of questions on here. – Lucas Kauffman Aug 1 '12 at 17:23
  • 2
    @DannyCruzeira Don't do that. Locking accounts for an hour allows for an attacker to generate a DoS on all user accounts using absolutely minimal bandwidth. – Polynomial Aug 1 '12 at 19:13

Lockouts after a set number of failed logins creates a DoS condition, where an attacker can efficiently prevent anyone from logging in. You also need to account for low-hanging-fruit attacks, where one attacker tries the 3 weakest passwords on every single account.

You should create a system that increases the delay between allowed login attempts up to a certain limit. A common choice is 1 second after the first failure, 5 seconds after the second, 20 after the third, and 45 seconds for all subsequent attempts. This should be the case per-account and per-IP.

CAPTCHA images are generally useless, since you can pay people in the 3rd world miniscule amounts of money to solve them, or set up phishing attacks to get unsuspecting users to fill them out for you. Besides, users find them annoying and they're often not solvable even by humans.

I highly recommend checking out The Definitive Guide to Forms-Based Website Authentication for a detailed and thorough description of the security methods you should consider.

  • 1
    Thanks for the detailed answer, and for sharing the link, seems like indeed "the Definitve Guide" ;) – DannyCruzeira Aug 1 '12 at 19:59
  • Absolutely. It deserves every last upvote it got, plus a hundred more. – Polynomial Aug 1 '12 at 20:00

Some sites do captcha after a few attempts, which may be wise. You could also do lockouts.

If you want your site to be secure one things you will require is an SSL certificate as cheap as a few bucks from: Namecheap or Globe SSL. These will prevent your credentials from being sent over the internet as plaintext.

Also, make sure that your site is protected against SQL injection, cross domain scripting, session jacking, and that the secure flag is set on any cookies.

That would provide a basic secure site login.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.