Re: preventing brute forcing passwords

2009-12-18 Thread Luke Plant
On Friday 18 December 2009 01:44:05 Jeremy Dunck wrote: > On Thu, Dec 17, 2009 at 6:47 PM, Luke Plant > wrote: ... > > > The problem with signals is that they don't return values, and so > > the mechanism can't interact with the actual login process. It > > can only notice that something is goi

Re: preventing brute forcing passwords

2009-12-17 Thread Jeremy Dunck
On Thu, Dec 17, 2009 at 6:47 PM, Luke Plant wrote: ... > The problem with signals is that they don't return values, and so the > mechanism can't interact with the actual login process.  It can only > notice that something is going on and try to stop it by some external > mechanism. Actually, they

Re: preventing brute forcing passwords

2009-12-17 Thread Mike Axiak
Hey guys, How slow can brute force attacks be? That is, why not just let the web server/load balancer/network stack rate limit client connections to prevent DoS, and effectively thwart brute force attacks? (I have no idea how good password guessing has been these days, so this isn't the most well

Re: preventing brute forcing passwords

2009-12-17 Thread Luke Plant
Hi Tom, > Hello Everyone, > > I noticed that Django's contrib.auth doesn't provide a mechanism > for detecting a password brute force attack. This is necessary for > a couple projects I'm working so I have to implement some kind of > solution and would really like to do it in such a way that i

Re: preventing brute forcing passwords

2009-12-17 Thread tie
And here is another stab at it: http://code.google.com/p/django-brutebuster/ On Dec 17, 9:30 pm, Tom wrote: > Hello Everyone, > > I noticed that Django's contrib.auth doesn't provide a mechanism for > detecting a password brute force attack. This is necessary for a > couple projects I'm working s

Re: preventing brute forcing passwords

2009-12-17 Thread Paul McLanahan
On Thu, Dec 17, 2009 at 2:30 PM, Tom wrote: > Hello Everyone, > > I noticed that Django's contrib.auth doesn't provide a mechanism for > detecting a password brute force attack. This is necessary for a > couple projects I'm working so I have to implement some kind of > solution and would really li

preventing brute forcing passwords

2009-12-17 Thread Tom
Hello Everyone, I noticed that Django's contrib.auth doesn't provide a mechanism for detecting a password brute force attack. This is necessary for a couple projects I'm working so I have to implement some kind of solution and would really like to do it in such a way that it could get contributed