Is it me or is the number of attempts stored in a cookie alone?
If this is the case what is the point of it? For someone to brute force the forum couldn't they just clear cookie after each attempt?
Am I missing something? Doesn't it store the number of attempts in the database somewhere also?
EDIT: If you are using a custom login, it is not sufficient to rely on the inbuilt loginattempts security provided by the forum. You must add extra measures to prevent a possible brute force attack.
Thanks.
It's stored in the loginattempts field in the users table so the user is locked out. In MyBB <= 1.4.3 is was in the sessions so it could be bypassed easier, now it's in the users table, the user itself is locked out, thus protecting it completely.
Deleting the cookie clears this...
The cookie in question is loginattempts.
Although it does says 5 attempts in my database, 'loginattempts' column.
When I get the login attempts error, I enter the wrong password once more, and the error shows. I then delete all site cookies in my browser. But now it lets me have another 5 attempts.
Maybe I'm getting confused with something else... once you get it wrong though it goes to the CAPTCHA page, so it isn't just a case of clearing cookies, would be hard for a bot to try and crack the CAPTCHA after every 3 attempts.
(2009-10-14, 03:12 PM)MattRogowski Wrote: [ -> ]Maybe I'm getting confused with something else... once you get it wrong though it goes to the CAPTCHA page, so it isn't just a case of clearing cookies, would be hard for a bot to try and crack the CAPTCHA after every 3 attempts.
Yeah I just tried it on this forum. It enabled me to login after I cleared cookies and it did indeed go to the CAPTCHA page. However I have a custom login, which doesn't have this CAPTCHA feature.
I guess I should add it as that's vulnerable to brute forcing.
Clearing your cookies shouldn't by-pass the login attempts, correct me if I am wrong.
You are wrong
Try it for yourself.
- Invalid password 5 times, (lockout message)
- Clear all sites cookies
- Attempt to login again, ( logged in )