MyBB Community Forums

MyBB's authentication system blocks excessive incorrect login attempts, however it appears to be solely cookie based. Deleting the loginattempts cookie that is set and incremented on each incorrect login appears to reset this limit.

Doesn't effectively having this limit controllable by the client defeat the purpose of limiting login attempts, or am I really missing something?

This is a standard method for providing a method to limit brute force attempts. While we understand there are various technicalities, that is the reality of these features to the extent that we can reasonably implement them.

There are other various methods such as using the IP to block, but due to the wide variety of proxies and the dynamic nature of routers/ISPs these days, it is basically useless to even consider that methodology.

As such, this is the only reasonable way to implement these type of technologies with what we can work with on the web.

Ryan