What is the best way to temporary block login attempts while not blocking the IP because this will be on networks with many people using the same IP and not reliant on a cookie since that can be easily cleared. Is there another way or is there no real way to do that?

This would be for a website login page. LAMP environment.

I would want to block brute force I am already locking out specific account attempts at 5 minutes intervals using the database to save each attempt with a datetime but I also want to block people who might be trying different accounts if they keep failing across multiple account attempts. I just don't know how to identify them other then the IP which I can't use or a cookie which can get deleted easily.

  • The question is unclear because you neither specify which kinds of login should get blocked (SSH, telnet, some specific web application, WiFi....) nor for what reason a specific attacker should be blocked - i.e. brute forcing mass of users, brute-forcing a specific user .... But, the defense depends on the kind of attack which is unknown in your case. For example rate limiting any login attempts is useful against somebody brute-forcing all users. Temporary blocking login attempts for a specific user is useful if somebody tries to attack this specific user etc. – Steffen Ullrich Mar 31 '18 at 4:13
  • You probably might use a combination of IP, cookie, fingerprinting the client, relying on differences between normal browsers and attack tools (often automatic attacks don't implement Javascript so having some Javascript implemented protection might help) and temporarily adding captchas to each or specific logins if too much failed logins occur. In general - the harder you make it for an attacker the harder you make it for a valid user so you have to find a balance somewhere. Technical details depend on your specific web application. – Steffen Ullrich Mar 31 '18 at 4:26
  • usually the login is delayed by 100 ms client side. It's simple, completely in the backend, non-annoying and renders a brute force attempt utterly inefficent – BlueWizard Mar 31 '18 at 12:49
  • Do you essentially want to avoid brute force? – Limit Apr 3 '18 at 17:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.