Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Login bruteforce, no captcha ? #561

Open
42aroger opened this issue May 26, 2019 · 2 comments

Comments

Projects
None yet
2 participants
@42aroger
Copy link

commented May 26, 2019

Hello,

I noticed there is no captcha at login, there is a checkbox for "strict login" but the explications link is broken

https://standardnotes.org/help/security

So is there any protection against bruteforce ?

@mobitar

This comment has been minimized.

Copy link
Member

commented May 26, 2019

Thanks for the heads up about the broken link, this has been fixed now. With regards to bruteforce protection, there is currently rate limiting in place, and this week, we'll be releasing exponential backoff as well, which locks the account exponentially after each failed attempt, up to 1 hour.

@42aroger

This comment has been minimized.

Copy link
Author

commented May 26, 2019

Great this sound promising, I will follow the ruby-server project

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.