How can I prevent brute-force attacks?

Question

I'm working on authentication and adding brute-force protection. I'm not sure how I should proceed.

Should I just do a flat block after 15 failed attempts for a certain IP address... or should I tie it to username? Should there be both a captcha threshold and a absolute cutoff?

Are there other patterns I should be following?

It would be helpful to know what type of system you are using. Linux/Windows? Apache? — hafichuk
@hafi I mentioned website. I'm making an authentication library to run on ASP.Net, so the platform depends on who uses my library. — Earlz
This is pretty subjective; I've tried to tweak it to be more "good" than "bad" subjective. And, don't forget, we have a website for general security questions, Information Security. — user1228
@Will will you please migrate this question there. I didn't think about it when I asked it, but it would fit in a lot more there because it's not direct code — Earlz

Haedrian Haedrian · Accepted Answer · 2011-11-18T19:02:48

If someone is really trying a brute force, he may have a range of IPs to work with. What you could do is put an ever increasing delay after each try, and making it username specific. CAPTCHAs can be beaten (to varying degrees) so put a captcha treshold, a 'slow things down' threshold and then just block it for an hour.

Note that brute forcing this manner is incredibly stupid so I'd be more worried about the attacker getting a copy of the passwords from the database through an injection or whatever.

How can I prevent brute-force attacks?

1 Answers