I want to add security to the system login. So here's my idea:

If a user tries to login with a valid username but invalid password, then count it as a failed login attempt and store it in the users database for that specific user.

After X failed login attempts for that user, take some specific action (eg. display captcha). However when that user is able to login successfully, reset the login attempts to in the database.

Is this logic any effective?

  • You don't appear to be using the stored passwords for anything; if that is true, then they add no value. – MCW May 22 '14 at 9:06
  • I didn't get what you mean. How should I be using the passwords with it? – jay May 22 '14 at 9:14
  • @jay what he meant was if you are storing the password as it is in the database? You should create the hash of the password and save the hash.When a user enters the passwords the hash should be created and compared against the saved hash.This way a compromised database proves to be useless(uhmm..) – techno May 22 '14 at 9:18
  • 3
    He didn't mention passwords or hashing passwords anywhere in this question. I have a feeling you guys are trying to argue a point that was omitted because it is irrelevant to the question. Let's play nice and contribute constructively. – David Houde May 22 '14 at 9:27
  • @techno I'm not storing the password as it is, I'm storing the hash. I thought it was not related to the question as I was just asking the logic of failed login attempts. – jay May 22 '14 at 9:38

The problem is that this only helps if one particular account is attacked. But instead of trying 100 passwords on one account, an attacker might also try one common password on 100 accounts. To prevent this, you also have to monitor the total number of failed logins and start displaying CAPTCHAs when the number gets exceptionally high.

For user-friendliness, the failed logins should expire automatically after a while. It doesn't make sense to keep the counter for more than, say, 24 hours.

Last but not least, be careful with race conditions when you actually implement this. Many people first check the number of failed logins and then increment the counter if needed. But this allows an attacker to send an arbitrary number of concurrent requests between the check and the increment, and each time the server will still “see” the old counter. You need a single query where you increment the counter and get the new value at the same time, and then you have to check that value. Different database systems have different techniques for this. In PostgreSQL, you can use an UPDATE query with a RETURNING clause. In MySQL, you can use an UPDATE query with the increment expression wrapped in LAST_INSERT_ID() and then get the incremented value with SELECT LAST_INSERT_ID(). Note that you can't just make a plain SELECT query after the update, because the counter might already have increased in the meantime.


That is the standard approach.

Either an incorrect id or password should count and you shouldn't tell them what is wrong.

You might also consider building in an increasing delay between allowed attempts.

  • 2
    An increasing delay without a (fairly low) upper bound gives the potential for a denial-of-service attack. – Mark May 22 '14 at 10:10
  • Agree that the upper bound should be sensible but really you are looking at disabling the account after a set number of attempts anyway so it doesn't make much difference. This is an enhancement not a replacement for the OP's suggested approach. All you are doing is slowing down automated hacking attempts. This is an important step. – Julian Knight May 22 '14 at 16:53

Yes, that is pretty much most login do.

You need to have captcha after several times invalid login to prevent brute force attack or if you need more security, you may need block the access if user attempted too many invalid login.

If possible, you should log every attempt to login not just count on how many login attempted then reset. This log will help you to understand and tracking back if there is serious breach to the system.

In addition, you may already know this. Use one way hash plus salt to store password in database.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.