|
For every smart webmaster, there is even a smarter cracker. What's stopping the cracker from checking the actual html produced, instead of the response code?
The obvious solution to prevent brute force, would be to "block" IP and/or username after X unsuccessful attempts. Even if the cracker has access to 1000s of proxies, it will make his job more difficult, especially if he doesn't know that his IP and/or username is getting "blocked."
The other solution is to display a random error page each time incorrect password is provided. This will make detecting whether the password is correct or not more difficult.
There are of course many other methods that can be used to protect from brute forcing, but if the cracker knows which protection method is used, he/she can usually go around it.
|