hotcut — Wed, 29 Aug 2001 14:57:16 +0000

Good idea.. However people likes to ruin it for others! They wouyld simply start disabling each others accounts

The IP blocking might be the best as of now...

Thanks for your help everyone!!

~casper

lurch — Wed, 29 Aug 2001 13:59:33 +0000

Why don't you just disallow any attempts to log in with that particular username after, say, 6 attempts or so... don't even bother checking where they're from.. just don't let anybody log in with that username for an hour or something. Maybe you could log whatever information about the attempted login that you can get so you can try and find patterns and track whoever is doing that stuff...

just some thoughts!

Peter J. Boettcher — Wed, 22 Aug 2001 20:29:29 +0000

I don't really see any way around this unless you do one of the following:

1) Setup a client certificate that is required to login.
2) Make your login page use a client-side active-x control.

The MAC/Physical address is not available in the Server Variables.

Your best bet is just to make it as much of a pain to hack as possible. Use hidden form fields, and only give them 3 or so attempts.

hotcut — Wed, 22 Aug 2001 19:55:35 +0000

Yes, I see your point...

My entire site relies on sessions, and therefore also cookies... The problem is that any real hacker will easily be able to simply delete those cookies!

Banning the IP aint good either... If someone for instance tryes to hack an account from a school, I would be blocking that whole complex for 30 minnutes

I believe that as of this cookies is the best thing... However, isn't there a better way? Hasn't every computer gotten other ways of being found than using the IP?
Again... I have heard a lot of this mac-addy... is that by any´chance something you know anything about?

Thanks for your help thus far

VCasper

Peter J. Boettcher — Wed, 22 Aug 2001 19:52:05 +0000

If you can force people to use cookies then I would use Sessions.

Add a counter on the Session_OnStart, example:

Sub Session_OnStart
Session("LoginCounter") = 0
End Sub

In your login handler page just increment as needed:

If Login = false Then Session("LoginCounter") = Session("LoginCounter") + 1

Then just build in the logic in the login form to deny any attepmts after a certain number:

If Session("LoginCounter") < 5 Then
Display Login form
Else
Response.Write "Exceeded valid login attempts"
End If

You could also record the IP number and disable it for 30 minutes or something, would make it more of a pain for the hackers since they would have to use a new IP for at least 30 minutes.

If you can't force cookies then maybe use hidden form fields and increment them as necessary.

You can't rely on IP since any serious hacker can spoof.