Login protection can be seen as the first defense layer of the application. Hackers may use tools or APIs to do brute-force login attacks. CAPTCHA is one of the approaches to distinguishing human from machine input. A CAPTCHA requires the client to complete visual-perception tasks. However, the CAPTCHA may be defeated by OCR or unwitting human labor. In addition to CAPTCHA, we can also have another layer of security defense to monitor the number of login failures. If the number of login failures reaches a certain threshold level, the system should take action, such as banning the IP source:
Tools/modules for login protection are summarized in the table:
|
Login protection techniques
|
Tools/Modules
|
|
Detect the number of login failures in logs and take action |
|
|
CAPTCHA solution to prevent machine brute-force login attacks |
|
