title: Login Security Philosophy
body: <p>I have been given some code of some other developer, who has created some login security policies. For example, if you try to login with a username that exists in the database, it will begin recording the amount of failed login attempts. Then after it reaches 3 login attempts, it adds another entry in the logs but adds the bit 1 to LockedOut.</p>
  
  <p>Do you guys believe this is a good security policy? Wouldn't someone trying to gain entry just try a large number of random usernames and forcibly lock everyone out of their account? It seems kind of a bad philosophy for security.</p>
  
  <p>I would think a better security procedure would be to lock out anyone who has made 3 attempts according to an IP table that tracks various user attempts and expires within 30 minutes or so to prevent DDoS.</p>
  
  <p>How do you guys design your login security ?? Here's what this developer did basically:</p>
  
  <pre><code>if username is in database:
     if first login: increase fail-attempt counter.
     if second login: lock out username.
     else: don't let him in.
  else:
  incorrect password.
  </code></pre>
  
  <p>edit: Final procedure:</p>
  
  <pre><code>public void ResolveTimeouts()
  {
      if (data.Expire &lt;= DateTime.Now)
      { // it will only delete ONE single entry from the database, 
        // that happens to be this user's IP
        // If and only if, The expiration date is older than right now.
          Delete(this.data);
          data.Attempts = 0;
      }
  }
  
  
  int uid = UserExists(username);
  if(uid &lt; 1){
    ResolveTimeOuts(); // this will delete IPs from table if expiration passed
    if(loginAttempts &gt;= 3){
      "Fail login, you have been locked out for " + TIMEOUT + " minutes";
      ExtendExpiration(TIMEOUT);
    } else {
      IncrementAttempts();
      "fail login, incorrect username or password.";
    }
  } else {
    if(authenticate(uid, password)){
      "Successfully logged in.";
    } else {
      // INSERT lock out specific username feature here.
      "failed login, incorrect username or password.";
    }
  }
  </code></pre>