[wp-hackers] Limit Login Attempts

[Jesse Friedman]

Correct me if I'm wrong but I think there is a setting to make it IP
agnostic so if the wrong password is entered for the same username X times
it will lock down the account. If it wasn't Limit Login then it might have
been something else.

I agree that Core adoptions should not be made on the fly in a situation
like this.


On Tue, Apr 16, 2013 at 11:25 AM, Chip Bennett <chip at chipbennett.net> wrote:

> I agree that Limit Login Attempts is useful, and does block single-IP
> brute-force attacks. (I use, and love, Limit Login Attempts.)
>
> But this particular botnet has demonstrated the ability to vary the IP
> address used to brute-force a given site. That behavior, IIRC, has been
> observed in the wild.
>
> My caution in adding Limit Login Attempts to core in response to this
> attack is that it would give a false sense of security, WRT both
> brute-force login attempts and DDoS.
>
>
> On Tue, Apr 16, 2013 at 11:14 AM, Chris Williams <chris at clwill.com> wrote:
>
> > Because if you only allow each IP four (Five? Six?) login attempts per
> > day, you essentially stop them all.
> >
> > In my log analysis, it's not the case that each IP only makes a few
> > attempts.  They try hundreds/thousands. Now they are hitting my block,
> > which requires a block of four attempts four times (16 total hits in a
> one
> > day period).
> >
> > If you look at the analysis on this, it all says something like "at 1000
> > attempts/minute it takes only N days to crack your short password".
>  Well,
> > at 4 attempts/day, that number becomes millennia.
> >
> > More to the point, why NOT do this?  It doesn't require everyone to
> change
> > their password.  It doesn¹t require everyone to remove the "admin"
> > account. It doesn't require any changes at all, yet helps protect even
> the
> > most lax of password choosers.
> >
> > On 4/16/13 7:53 AM, "Chip Bennett" <chip at chipbennett.net> wrote:
> >
> > >If 90,000 unique IP addresses are attempting a brute-force attack, in
> > >which
> > >no single IP address makes more than a handful of attempts, how
> effective
> > >will it be to limit login attempts by IP address?
> > >
> > >I would support the inclusion of Limit Login Attempts in core, based on
> > >its
> > >utility; however, it won't do any particular good in dealing with the
> full
> > >potential of the current attack.
> > >
> > >
> > >On Tue, Apr 16, 2013 at 10:36 AM, Chris Williams <chris at clwill.com>
> > wrote:
> > >
> > >> I made a rather reasonable proposal, and received plenty of advice,
> but
> > >> the proposal never was vetted.  Now the issue of brute force attacks
> has
> > >> even received Matt's attention:
> > >> http://ma.tt/2013/04/passwords-and-brute-force/
> > >>
> > >> On the dozen or so WP sites I manage, wp-login.php is frequently among
> > >>the
> > >> top 10 most often accessed pages.  Yes, I have removed the admin
> > >>account.
> > >>  Yes, I have robust passwords.  Yes, I have plugins to help.  Yes, I
> am
> > >> playing whack-a-mole and blocking the IPs one-by-one.  But brute force
> > >> attempts to login are happening at an alarming rate.
> > >>
> > >> Wordpress should include login attempt limiting as part of core:
> > >>
> > >>  *   Logging into WP is a core feature
> > >>  *   Usernames and passwords are a core part of WP security
> > >>  *   Password strength metering is a core feature
> > >>  *   Limiting guesses is a key way to defend against brute force
> attacks
> > >>
> > >> Is this the end-all-be-all to WP security?  No, of course not.
> > >>
> > >> But much of WP security depends on not being able to get access to
> > >> privileged accounts.  And limiting login attempts is a simple,
> > >> straightforward, non-invasive way to dramatically improve that
> security.
> > >>  It has almost no impact on the good guys and virtually eliminates a
> > >>common
> > >> exploit path.
> > >>
> > >> Not every WP site allows comments, so having Akismet a plugin makes
> > >>sense.
> > >>  Many other other plugins make sense as plugins.  But logging into WP
> > >>is an
> > >> essential facility.
> > >>
> > >> Limiting login attempts should be part of core.
> > >>
> > >> Chris
> > >> _______________________________________________
> > >> wp-hackers mailing list
> > >> wp-hackers at lists.automattic.com
> > >> http://lists.automattic.com/mailman/listinfo/wp-hackers
> > >>
> > >_______________________________________________
> > >wp-hackers mailing list
> > >wp-hackers at lists.automattic.com
> > >http://lists.automattic.com/mailman/listinfo/wp-hackers
> >
> > _______________________________________________
> > wp-hackers mailing list
> > wp-hackers at lists.automattic.com
> > http://lists.automattic.com/mailman/listinfo/wp-hackers
> >
> _______________________________________________
> wp-hackers mailing list
> wp-hackers at lists.automattic.com
> http://lists.automattic.com/mailman/listinfo/wp-hackers
>



-- 
thanks
*
*
*jesse friedman*
jes.se.com *
*
Book: Web Designers Guide to WordPress -
http://wdgwp.com/onamazon<http://wdgwp.com/onamazon>
Twitter: @professor <http://twitter.com/professor>
Facebook: Like<https://www.facebook.com/pages/Jesse-Friedman/204793299545174>