Originally Posted by
Hyde
Have you ever considered implementing some sort of new system, to make dictionary attacks/whatever they use nowadays ineffective/inefficient? Such as a pin/key word when a user logs on from a different IP address, which will not let the hacker access the user's items(The system makes that ip the home address if the pin/key word is answered correctly)?
Considered and dismissed. It'd be too tedious for those of us who log in from many places. The 5 login attemts should be sufficient with most dictionary/brute force attacks anyway. Also, some of the users have very dynamic IP ranges ( /12 DHCP pool ) and such a system would have to be very generalized to avoid just being cumbersome for these people.