I have almost finished developing my login system and there is one more thing that I'm not sure about. So many debates I found on the internet about counting invalid logins and locking users account. My system stores user names and passwords (that are salted[for each user different salt] and hashed) in database. If user enters invalid user name or password I keep track of their Username, Password, LoginTime, SessionID, IP and Browser. Here is example:
LoginID LoginTime LoginUN LoginPW LoginSessionID LoginIP LoginBrowser 1 2018-03-15 13:40:25.000 jpapis test E72E.cfusion 10.18.1.37 Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0 98 2018-03-15 13:48:45.000 mhart mypass55 E72E.cfusion 10.12.1.87 Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0 32 2018-03-15 14:29:14.000 skatre 1167mmB! 378E.cfusion 10.36.1.17 Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0
I'm wondering if I should lock account after X attempts? If so what would be the best practice to do that? Here is one approach that I found:
SELECT COUNT(LoginID) AS countID, DATEDIFF(mi,LoginTime,GETDATE ( )) AS TimeElapsed FROM FailedLogins WHERE (LoginUN = '#username#' OR LoginSessionID = '#SESSION.sessionid#' OR LoginIP = '#REMOTE_ADDR#') AND DATEDIFF(mi,LoginTime,GETDATE ( )) <= 60 GROUP BY LoginID, LoginTime HAVING COUNT(LoginID) >= 5;
Query above will look for username, sessionID or IP address. If either of these it's found in FailedLogin table within 60min and it's greater than 5 I would lock the account. Only problem here is I'm not sure what this would prevent, brute force attack can send way too many attempts in 60min so I'm not sure what would be the benefit of checking failed logins this way. Is there better way to handle failed logins now days? Should I even lock the account? If anyone can provide some thoughts and examples please let me know. Also I want to share some details about the system. We do not have any money transaction in the system or tied to user accounts. We do have sensitive information in the system and that's why I would like to implement security feature to prevent hackers of trying to break password with some of hacker techniques. Thank you.