Discuss introducing a challenge before login attempt limit is exceeded

[ryanfeeley]

Currently, when the number of login attempts exceeds our threshold, we simply put a "Attempt limit exceeded" error message above the login form.

Before blocking login attempts, we should introduce a challenge to verify that the user is indeed a human.

What are the best ways to accomplish this that deliver a great UX on mobile and desktop, and align with our engineering goals?

[vladikoff]

We can try using http://visualcaptcha.net/, it can be self-hosted and let us customize the options if needed

[vladikoff]

[ryanfeeley]

Final draft. Select object should have 1px dotted outline, #0095dd, no fill.

[ryanfeeley]

Outstanding questions, perhaps of interest to @ckarlof:

1. Is the number of attempts a user gets before seeing the challenge fixed in any way? (i.e. can we show a count down?)
2. How many times is the user allowed to fail the challenge?
3. What happens when the user exceeds the number of times they can fail the challenge?

[ryanfeeley]

@vladikoff Is there a way we can separate the captcha from the login? Like show it in a modal or on its own step?

[vladikoff]

From mtg: messaging might need to be adjusted if ip is blocked and it's user's first time

[rfk]

messaging might need to be adjusted if ip is blocked and it's user's first time

Right, so there's two reasons a user might encounter this error:

• They individually are trying the same password over and over again on their account
• They're on a shared IP that we've rate-limited due to other activity, but it's actually their first try at submitting the password

We should have the server return a different errno in these two different cases, so that we can give more accurate messaging to the user. I've noticed a few folks on twitter lately complaining that "FxA tells me attempt limit exceeded on my first try, wtf??".

[shane-tomlinson]

@ryanfeeley - can you open a feature card for this so we can prioritize appropriately?

[vladikoff]

Need to add result of discussion... and move to feature doc or something..

[vladikoff]

moved to mozilla/fxa#153