Hi Adam, similarly to standard security, the simplest way is to add a mechanism whereby the account becomes locked after 3 failed attempts. This makes dictionary attacks worthless.
In terms of a web app, I've also seen people only lock an account as accessed from a particular ip address (IE the one the original three failures came from) but a reasonably smart crackerjack program will circumvent that. cheers, Toby Monday, February 24, 2003, 3:38:19 PM, you wrote: AC> Hey Everyone.. AC> At the hack-proofing CFMX session at MXDU, Spike AC> Mentioned a 'dictionary attack' or something similar AC> Where someone will pound your cf templates with lots-o AC> Username/password combos.. AC> What are some of the methods peoples use to try and AC> Safeguard against this kind of thing..? AC> Regards, AC> Adam Chapman AC> Virtualtours.com.au AC> mailto:[EMAIL PROTECTED] AC> Phone: 1300 366 122 AC> (Int: +61 3 9720 5733) AC> Fax: +61 3 9720 6377) AC> --- AC> You are currently subscribed to cfaussie as: [EMAIL PROTECTED] AC> To unsubscribe send a blank email to [EMAIL PROTECTED] AC> MX Downunder AsiaPac DevCon - http://mxdu.com/ --------------------------------------- Life is poetry - write it in your own words. --------------------------------------- Toby Tremayne Technical Team Lead Code Poet and Zen Master of the Heavy Sleep Toll Solutions 154 Moray St Sth Melbourne VIC 3205 +61 3 9697 2317 0416 048 090 ICQ: 13107913 --- You are currently subscribed to cfaussie as: [EMAIL PROTECTED] To unsubscribe send a blank email to [EMAIL PROTECTED] MX Downunder AsiaPac DevCon - http://mxdu.com/
