LoginTimer by Ryan Cramer

Normalize successful and failed login times to prevent timing attacks.

Login Timer for ProcessWire

Prevents timing attacks by enabling normalization of login times so that a failed login is no faster than a successful login.

This prevents timing attacks from discovering any information about good vs. bad user names or passwords based on the time taken to process the login request. It does this by remembering how long successful logins take and applying that same amount of time to failed logins.

Please see the post with Details and documentation for this module.

Installation

  1. Copy all files from this module to /site/modules/LoginTimer/
  2. Go to Modules > Refresh in your admin.
  3. Install the Site > Login > Login Timer module.
  4. Logout and log back in.

The last step above will prime the login timer so that it can establish an appropriate login time for your system. This time is recalculated up to 24 times per day.

Once installed, this module will automatically apply to all logins from ProcessWire’s $session API variable. For instance, logins from the ProcessWire login form, and the LoginRegisterPro module are covered by this module.

Install and use modules at your own risk. Always have a site and database backup before installing new modules.

Latest news

  • ProcessWire Weekly #527
    In the 527th issue of ProcessWire Weekly we'll check out what's new in the core this week, introduce a new third party module called Lister Calculator, and more. Read on!
    Weekly.pw / 15 June 2024
  • ProFields Table Field with Actions support
    This week we have some updates for the ProFields table field (FieldtypeTable). These updates are primarily focused on adding new tools for the editor to facilitate input and management of content in a table field.
    Blog / 12 April 2024
  • Subscribe to weekly ProcessWire news

I just love the easy and intuitive ProcessWire API. ProcessWire rocks!” —Jens Martsch, Web developer