Login bruteforce, no captcha ?

[42aroger]

Hello,

I noticed there is no captcha at login, there is a checkbox for "strict login" but the explications link is broken

https://standardnotes.org/help/security

So is there any protection against bruteforce ?

[moughxyz]

Thanks for the heads up about the broken link, this has been fixed now. With regards to bruteforce protection, there is currently rate limiting in place, and this week, we'll be releasing exponential backoff as well, which locks the account exponentially after each failed attempt, up to 1 hour.

[42aroger]

Great this sound promising, I will follow the ruby-server project