Re: Why do you have to worry about Brute Force Attacks?

Let me counter with this question: Why would any legitimate user need more than X attempts within N minutes to log in? If they know their password, one attempt should be enough. If they don't, there's always the "forgot password" link that all good sites (should) have. A few attempts should be given in leeway for those like me who have many passwords and bad memories, or for those who have issues with typos.

If you don't want to do it without good reason, then I recommend you keep a sharp eye on your HTTPD logs. Of course, by the time you recognize there is an issue, the attacker may have already succeeded. Which brings us back to the "why not just do it" argument.

---
It's all fine and dandy until someone has to look at the code.

Comment on Re: Why do you have to worry about Brute Force Attacks?

Replies are listed 'Best First'.
Re^2: Why do you have to worry about Brute Force Attacks? by Anonymous Monk on Sep 27, 2006 at 13:16 UTC
If they don't, there's always the "forgot password" link that all good sites (should) have. So now, instead of cracking a secure password, all the bad guys (or your nosey neighbours) have to do is find out your dog's name, mother's maiden name, or some other easy to learn (or guess) response? I think those links are handy. I don't pretend any system "protected" by them is secure. They're like a locked front door with the key hidden under the doormat by the back entrance; not as secure as they really appear.	[reply]
Re^3: Why do you have to worry about Brute Force Attacks? by eric256 (Parson) on Sep 27, 2006 at 19:02 UTC
Err most of the ones i've used email you the new password after checking the right answer. So they would have to know your dogs name and have access to your email. ___________ Eric Hodges	[reply]
Re^4: Why do you have to worry about Brute Force Attacks? by Anonymous Monk on Sep 27, 2006 at 20:53 UTC
Err most of the ones i've used email you the new password after checking the right answer. So they would have to know your dogs name and have access to your email. Email is sent out in plaintext over the network, remember?	[reply]
Re^5: Why do you have to worry about Brute Force Attacks? by eric256 (Parson) on Sep 27, 2006 at 22:58 UTC


The stupid question is the question not asked
	PerlMonks