Originally Posted by invisal

It is not 100% match for using OCR to read the image right? Plus the image is created which randomly content. Even the attacker collect more than 1000 of images that have been appear on the login, the next image will be probally different from the previous. I guess the robots aren't so effective after all now. Correct me if i am wrong...

A simple pattern is 5 failed login attempts on a username. This is without regards to who made the attempts or from where or what IP

Originally Posted by digital-ether

A simple pattern is 5 failed login attempts on a username. This is without regards to who made the attempts or from where or what IP (these are factors that can be changed by the attacker), just the fact that there exists 5 failed login attempts on a single username in the last 15 minutes.

Originally Posted by cereal

...I agree with you, and probably this is the best solution, but an attacker could always write a brute force program that tries four password per username and then switch to the next username until the timeout is finished, no?

Or my guess is just fantasy?!

Originally Posted by tirstan

Just posting to thank digital-ether for the posts. Love the social based CAPTCHA example.

Spend some time researching because I want to implement this feature as well. This is what I came up with. Comments appreciated.

DB table:
CREATE TABLE `auth` (
`id` int(11) NOT NULL,
`username` varchar(40) NOT NULL,
`password` varchar(60) NOT NULL,
`email` varchar(60) NOT NULL,
`role` varchar(10) NOT NULL default '0',
`timeStamp` varchar(20) NOT NULL,
`incorrect` tinyint(4) NOT NULL default '0',
PRIMARY KEY (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=latin1;

used varchar for timeStamp so I could store unix timestamp (MySQL did not like format). DateTime has too many variables to account for (i.e. what if the time is 23:50?) and is a bit of a pain to convert.
Now the Goods:

Help with Code Tags

php Syntax (Toggle Plain Text)

function protectLogin(){
	  Global $dbx;
	  $protect=false;
	  $user=$_POST['username'];
	  $password=$_POST['password'];
	  $query= "Select * from auth where username = '".mysql_real_escape_string($user)."'";    
      $userQuery = $dbx->query($query);		
      if($row = $userQuery->fetchRow(DB_FETCHMODE_ASSOC)){
 
			 $_SESSION['authorize']['id']=$row['id'];
			 $_SESSION['authorize']['username']=$row['username'];
			 $_SESSION['authorize']['timeStamp']=$row['timeStamp'];
			 $_SESSION['authorize']['incorrect']=$row['incorrect'];			
			 $_SESSION['authorize']['role']=$row['role'];			 
 
			 if( md5($password)==$row['password'] && ($row['incorrect']!=5) ){
			  	//echo " passwords match </br>";//set session
			 	$_SESSION['authorize']['register']=1; 				 
				header ("Location: ./index.php");										
			 }else{			
			   $protect=true;//incorrect password or has had 5 incorrect logins
			 }					        
	  }		
	  $userQuery->free();		
	  return $protect;
}
 
//***********************************************************************************
// this section displays email form for lost passwords shown only when login fails		
//***********************************************************************************
function wrongPass($tpl){
    Global $dbx; 
	//add variables from db
	$id=$_SESSION['authorize']['id'];
	$user=$_SESSION['authorize']['username'];	 
	$date=$_SESSION['authorize']['timeStamp'];
	$incorrect=$_SESSION['authorize']['incorrect'];	
	// $ip=$_SERVER['REMOTE_ADDR'];//if you want to save the ip of incorrect logins	 						
 
		//echo " the unix timestamp stored is <br>".$date."<BR>";
		//echo " the date is ".date("F j, Y, g:i a",$date)."<BR>";
		$storedDate=$date+900;//if less than this increment count
		//echo " date plus 900 seconds ".date("F j, Y, g:i a",$storedDate)."<BR>";
 
		$time=mktime();//current time
		//echo " the unix timestamp now is <br>".$time."<BR>";		
		//echo " incorrect attempts = $incorrect <br>";
		//echo " the date is ".date("F j, Y, g:i a",$time)."<BR>";
 
		$query="UPDATE `auth` SET ";
		if($storedDate>$time){//within 15 minutes of previous attempt		   
		   if($incorrect!=5){//not already 5 increase number
		     $query.=" `incorrect`='".($incorrect+1)."'";
		     $query.="WHERE `id`='".$id."'";
		     //echo $query."<BR>";
	 	     $dbx->query($query);
		   }		
		}else{//first invalid attempt in fifteen minutes		   	
			$query.="`timeStamp`= '".$time."', `incorrect`='1'";
		    $query.="WHERE `id`='".$id."'";
		    //echo $query."<BR>";
	 	    $dbx->query($query);
		}		
 
	    $lost=centerColumnHead("Unable to login!!!", "Please Try again Later");			
		$lost2="<br /><br /></div> </td></tr>";		
 
		$tpl->setVariable("centerColumnContent", $lost);
		$tpl->setVariable("centerColumnContent2", $lost2);
 
	return $tpl;	
}

function protectLogin(){ Global $dbx; $protect=false; $user=$_POST['username']; $password=$_POST['password']; $query= "Select * from auth where username = '".mysql_real_escape_string($user)."'"; $userQuery = $dbx->query($query); if($row = $userQuery->fetchRow(DB_FETCHMODE_ASSOC)){ $_SESSION['authorize']['id']=$row['id']; $_SESSION['authorize']['username']=$row['username']; $_SESSION['authorize']['timeStamp']=$row['timeStamp']; $_SESSION['authorize']['incorrect']=$row['incorrect']; $_SESSION['authorize']['role']=$row['role']; if( md5($password)==$row['password'] && ($row['incorrect']!=5) ){ //echo " passwords match </br>";//set session $_SESSION['authorize']['register']=1; header ("Location: ./index.php"); }else{ $protect=true;//incorrect password or has had 5 incorrect logins } } $userQuery->free(); return $protect; } //*********************************************************************************** // this section displays email form for lost passwords shown only when login fails //*********************************************************************************** function wrongPass($tpl){ Global $dbx; //add variables from db $id=$_SESSION['authorize']['id']; $user=$_SESSION['authorize']['username']; $date=$_SESSION['authorize']['timeStamp']; $incorrect=$_SESSION['authorize']['incorrect']; // $ip=$_SERVER['REMOTE_ADDR'];//if you want to save the ip of incorrect logins //echo " the unix timestamp stored is <br>".$date."<BR>"; //echo " the date is ".date("F j, Y, g:i a",$date)."<BR>"; $storedDate=$date+900;//if less than this increment count //echo " date plus 900 seconds ".date("F j, Y, g:i a",$storedDate)."<BR>"; $time=mktime();//current time //echo " the unix timestamp now is <br>".$time."<BR>"; //echo " incorrect attempts = $incorrect <br>"; //echo " the date is ".date("F j, Y, g:i a",$time)."<BR>"; $query="UPDATE `auth` SET "; if($storedDate>$time){//within 15 minutes of previous attempt if($incorrect!=5){//not already 5 increase number $query.=" `incorrect`='".($incorrect+1)."'"; $query.="WHERE `id`='".$id."'"; //echo $query."<BR>"; $dbx->query($query); } }else{//first invalid attempt in fifteen minutes $query.="`timeStamp`= '".$time."', `incorrect`='1'"; $query.="WHERE `id`='".$id."'"; //echo $query."<BR>"; $dbx->query($query); } $lost=centerColumnHead("Unable to login!!!", "Please Try again Later"); $lost2="<br /><br /></div> </td></tr>"; $tpl->setVariable("centerColumnContent", $lost); $tpl->setVariable("centerColumnContent2", $lost2); return $tpl; }

What could you do with the ip address of the incorrect logins?