note 17383 deleted from function.md5 by jimw

Re: adding delay to login-page This won't work, since the cracker can fire multiple request concurrently to your webserver. In fact, your solution is the same as a high network-delay from the hacker's point of view. It would work however, if the call to the login-procedure was synchronized, meaning only one login could be active at a time. Still this is no good solution, as you would become vulnerable against DoS-attacks. The delay is more a pain the user's big a (if set to high) instead of the hackers. If you have no synchronization - forget about it! Depending on the users that can access the login and the administrators time, a solution against brute-force might be to mark an account as disabled if login fails multiple times.