[mindcrime]

OK, well, here's an initial observation:

1. Your login page leaks information, as it returns "username not found" if you enter an invalid username. This is a bad idea. Better to simply say "login failed" in any case. Now, thanks to a few minutes of playing around, I have a fairly good idea that "admin" is a valid username on projecteuler.net. For the sake of argument, let's assume that's a real account, and actually has some administrative access... that's a bad idea. "Security through obscurity" is oft derided, but no sense making it easy for the bad guys. Make your admin username "flummoxedrabbit" or something that nobody bothers trying. As it is, I'm hoping this "admin" account is a dummy or a honeypot or something, but if it isn't, I definitely encourage you to change that and quit leaking username validity information.

2. From the limited testing I did, it doesn't appear that you limit the number of failed login attempts. Or if you do, the login limit is awfully high. I tried logging in 10 times and as far as I can tell, I could have kept going. If there really is no limit, it's probably not that hard to brute force your password. There are plenty of scripts and browser plugins to sit there and try to login repeatedly, trying to brute force forms like that.

3. In addition to limiting the number of login attempts, it's possibly a good idea to add a steadily increasing delay before accepting another login try from the same IP address, after each failed login. This will slow down at least some attempts to brute force your password.

4. You could consider some sort of Multi-Factor Authentication setup.

5. You could also consider adding code to do something similar to what fail2ban does, and automatically block connections from an IP where more than X failed logins originate in some period of time.

[function_seven]

Regarding #1, telling the user that their login failed doesn't eliminate their ability to enumerate existing usernames. All they have to do instead is attempt to register a new account with the username they're testing. At some point, the site will have to tell them that the username already exists.

#2-#5 are all good points, though, and would help prevent username enumeration as well.

[mindcrime]

Regarding #1, telling the user that their login failed doesn't eliminate their ability to enumerate existing usernames. All they have to do instead is attempt to register a new account with the username they're testing. At some point, the site will have to tell them that the username already exists.

Agreed, but I would lean towards giving the bad guys as few tools as possible. If you require a captcha to register, and if you limit the number of registration attempts, you can also cut down on that channel.

That's not to say that this stuff is the be all / end all of course. It would probably be better to eliminate username/password combos altogether and do everything with keypairs, but until that day comes...

[shkkmo]

Except you aren't really limiting the tools available to the bad guys, you are just making the UX worse. I find this 'best practice' annoying design and doubt that it has mitigated any attacks.

[dongkyun]

Using what Daguva mentioned above, it looks like admin (https://projecteuler.net/profile/admin.png) is just a regular accounts, compared to say, euler (https://projecteuler.net/profile/euler.png)

[mindcrime]

Yep, which makes his discovery much more damaging. That was a good find, and something PE should definitely fix!

[mindcrime]

Another area I'd suggest looking into is your "recover your account key" setup. If the keys really really are random, then this is probably fine. But if there's any flaw resulting in your generated keys being less than ideally random, somebody could have figured out a way to generate an account recovery key, and then used that to steal an administrative account. That is, assuming your administrative user even has that option. If it does, it might be a good idea to disable that, since you presumably have direct db access anyway, and can always backdoor your way in if you forget your own password.

[krapp]

There are times when I lie in bed at night and stare into the shadows and think to myself web based administration is probably always a bad idea.

Unfortunately, the alternatives are unthinkable for everyone who isn't a programmer.

[krapp]

csrf tokens would be nice too.

[tedunangst]

There's also an account named "backdoor".

[mindcrime]

And "root" as well, apparently.