note 105149 added to function.sleep

A really simple, but effective way of majorly slowing down bruit force attacks on wrong password attempts. In my example below, if the end-user gets the password correct, they get to log in at full speed, as expected. For every incorrect password attempt, the users response is delayed by 2 seconds each time; mitigating the chances of a full bruit force attack by a limit of 30 lookups a minute. I hope this very simple approach will help make your web applications that little bit more secure. Ashley <?php public function handle_login() { if($uid = user::check_password($_REQUEST['email'], $_REQUEST['password'])) { return self::authenticate_user($uid); } else { // delay failed output by 2 seconds // to prevent bruit force attacks sleep(2); return self::login_failed(); } } ?> ---- Server IP: 69.147.83.197 Probable Submitter: 81.107.151.224 ---- Manual Page -- http://www.php.net/manual/en/function.sleep.php Edit -- https://master.php.net/note/edit/105149 Del: integrated -- https://master.php.net/note/delete/105149/integrated Del: useless -- https://master.php.net/note/delete/105149/useless Del: bad code -- https://master.php.net/note/delete/105149/bad+code Del: spam -- https://master.php.net/note/delete/105149/spam Del: non-english -- https://master.php.net/note/delete/105149/non-english Del: in docs -- https://master.php.net/note/delete/105149/in+docs Del: other reasons-- https://master.php.net/note/delete/105149 Reject -- https://master.php.net/note/reject/105149 Search -- https://master.php.net/manage/user-notes.php