starred/cypht

Fork 0

mirror of https://github.com/cypht-org/cypht.git synced 2026-04-25 04:56:03 +03:00

[GH-ISSUE #94] Create a brute force login protection module set #75

New issue

Open

opened 2026-02-25 21:34:03 +03:00 by kerem · 8 comments

kerem commented

2026-02-25 21:34:03 +03:00

Owner

Originally created by @jasonmunro on GitHub (Jun 28, 2016).
Original GitHub issue: https://github.com/cypht-org/cypht/issues/94

Originally assigned to: @Danelif on GitHub.

lots of great ideas on this here:
https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks

Originally created by @jasonmunro on GitHub (Jun 28, 2016). Original GitHub issue: https://github.com/cypht-org/cypht/issues/94 Originally assigned to: @Danelif on GitHub. lots of great ideas on this here: https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks

kerem added the

enhancement

new module set

Security

labels

2026-02-25 21:34:03 +03:00

kerem commented

2026-02-25 21:34:03 +03:00

Author

Owner

@marclaporte commented on GitHub (May 7, 2024):

@Danelif please advise.

@marclaporte commented on GitHub (May 7, 2024): @Danelif please advise.

kerem commented

2026-02-25 21:34:03 +03:00

Author

Owner

@Danelif commented on GitHub (May 7, 2024):

Alright

@Danelif commented on GitHub (May 7, 2024): Alright

kerem commented

2026-02-25 21:34:03 +03:00

Author

Owner

@Danelif commented on GitHub (May 7, 2024):

I have read this article carefully https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks and found it very relevant. But some techniques are not included in it.
If we want to create brute-force login protection, consider including the (2-3) FA technique (2-3 Factor Authentication). The user might provide a unique OTP sent to his email address or mobile phone once the username/password is correct.
Also, The limitation of attempting to log in can be considered from a single IP address. If the limit is reached we can suggest the user to recover it password by emailing an OTP to the email in our database.

@Danelif commented on GitHub (May 7, 2024): I have read this article carefully https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks and found it very relevant. But some techniques are not included in it. If we want to create brute-force login protection, consider including the (2-3) FA technique (2-3 Factor Authentication). The user might provide a unique OTP sent to his email address or mobile phone once the username/password is correct. Also, The limitation of attempting to log in can be considered from a single IP address. If the limit is reached we can suggest the user to recover it password by emailing an OTP to the email in our database.

kerem commented

2026-02-25 21:34:03 +03:00

Author

Owner

@marclaporte commented on GitHub (May 7, 2024):

@Danelif Thank you, please look at how it is done in Tiki to get some more good ideas.

@marclaporte commented on GitHub (May 7, 2024): @Danelif Thank you, please look at how it is done in Tiki to get some more good ideas.

kerem commented

2026-02-25 21:34:03 +03:00

Author

Owner

@Danelif commented on GitHub (May 16, 2024):

@marclaporte In tiki 2FA is done using Google2FA php library. Good idea indeed. Instead of using OTP, in Tiki, we use TOTP. But the only problem is that there is not much documentation and usage I wonder why?

@Danelif commented on GitHub (May 16, 2024): @marclaporte In tiki 2FA is done using Google2FA php library. Good idea indeed. Instead of using OTP, in Tiki, we use TOTP. But the only problem is that there is not much documentation and usage I wonder why?

kerem commented

2026-02-25 21:34:03 +03:00

Author

Owner

@marclaporte commented on GitHub (May 17, 2024):

Some docs:

TOTP uses time, so the code changes every 30 seconds.

@marclaporte commented on GitHub (May 17, 2024): Some docs: - https://doc.tiki.org/PluginTOTP - https://doc.tiki.org/Two-factor-authentication TOTP uses time, so the code changes every 30 seconds.

kerem commented

2026-02-25 21:34:03 +03:00

Author

Owner

@Danelif commented on GitHub (Jul 10, 2024):

@marclaporte I have seen how 2FA works in tiki. It could be great to to the same in cypht

@Danelif commented on GitHub (Jul 10, 2024): @marclaporte I have seen how 2FA works in tiki. It could be great to to the same in cypht

kerem commented

2026-02-25 21:34:03 +03:00

Author

Owner

@marclaporte commented on GitHub (Jul 10, 2024):

ok, please proceed as a medium priority. High priority is fixing bugs before adding new features.

@marclaporte commented on GitHub (Jul 10, 2024): ok, please proceed as a medium priority. High priority is fixing bugs before adding new features.