note 54393 deleted from function.sleep by danbrown

Note Submitter: vmadman at gmail.com ---- I think you guys are over thinking this. It's always nice to code expecting the worse, but odds are, you will never have someone targetting you for exploits in your custom code. They would rather find exploits in a nuke site so that they can do the most damage. With that aside, an effective way to prevent brute force attacks would be to only allow a certain number of authentication attempts at once, regardless of the IP. 15 would be a safe number, and sleep(10). Brute force attacks can only be successful under two conditions, 1) be able to process insanely fast, or 2) get really lucky and find an easy password. When an authentication request starts, write a row to a mySQL table and delete it when you're done. Also mysql_num_rows when you start the request. Deny immediately if num_rows returns greater than 15, sleep 10 seconds if num_rows exceeds 10, and sleep 5 seconds no matter what. This progressive security approach would not only be effective, but would baffle the cracker. (he cannot see your code and would not know what is going on) But do not let anyone tell you any different. If he decides to DoS you (ane he has the resources to pull it off).. there is nothing you can do to stop it outside of notifying your ISP. -Luke