XF 2.2 Is there a way to lock an account after X amount of failed login attempts?

[PumpinIron]

My forum is suffering a problem as of lately with user accounts being hacked.

What's happening (near as I can tell) is that hackers from overseas are getting into members accounts by guessing their passwords. Since some of these guys have strong passwords I have to imagine they are doing this using a program that attempts to cycle through password combinations.

Once they get in to the members account they post a listing in the classified section and people end up sending them money via Zelle (stupid, I know) only to find out that it was a well known member who had their account hacked.

My thought is that if I could lock accounts after X amount of failed password attempts this might be somewhat of a security measure to hopefully prevent this.

Does such an add-on or feature exist or am I just missing it in the ACP?

 

[Paul B]

Locks are placed on accounts which have incorrect password attempts.

The lock timer increases automatically each time there is a new incorrect attempt.

 

[PumpinIron]

Locks are placed on accounts which have incorrect password attempts.

The lock timer increases automatically each time there is a new incorrect attempt.

Alright, then that really begs the question of how these well known members with strong passwords are getting their accounts hacked.

 

[Mr Lucky]

Make sure in ACP > user options you have the login limit method set to lock out after 4 attempts in 15 minutes. I trust that over recaptcha

 

[PumpinIron]

Make sure in ACP > user options you have the login limit method set to lock out after 4 attempts in 15 minutes. I trust that over recaptcha

Yep, it is enabled. That makes this all even more confusing.

 

[nodle]

I would make sure that you allow 2FA. Also I don't know if it is possible or not to force 2FA for users?

 

[PumpinIron]

I would make sure that you allow 2FA. Also I don't know if it is possible or not to force 2FA for users?

Do you know where the 2FA setting is in the ACP? I'm searching but I can't seem to find what section it's under.

 

[Paul B]

Also I don't know if it is possible or not to force 2FA for users?

Yes, it is.

In the user group permissions.

 

[PumpinIron]

Yes, it is.

In the user group permissions.

View attachment 292403

Thank you!

 

[Mr Lucky]

Alright, then that really begs the question of how these well known members with strong passwords are getting their accounts hacked.

If they have the same strong password for several sites and any one of those is compromised then the account hijacker can get straight in. So 2FA is good, or else you can batch update users to need to set a security lock, e.g. they must change/reset password.

I would do this for inactive users, but also batch email active users making them aware that they should not use passwords on more than one site and to change them from time to time. It's again but password management like 1 Password and Keychain can help.

Edit: this addon I think checks for compromised passwords :

Password Tools

Password Tools Description Source This modification mostly follows the principles of Dan Wheelers password strength estimator zxcvbn. It does not weight password strength by their combination of upper/lower letters, special characters and...

xenforo.com

 

[Dragonfruit]

If they have the same strong password for several sites and any one of those is compromised then the account hijacker can get straight in. So 2FA is good, or else you can batch update users to need to set a security lock, e.g. they must change/reset password.

I would do this for inactive users, but also batch email active users making them aware that they should not use passwords on more than one site and to change them from time to time. It's again but password management like 1 Password and Keychain can help.

Edit: this addon I think checks for compromised passwords :

Password Tools

Password Tools Description Source This modification mostly follows the principles of Dan Wheelers password strength estimator zxcvbn. It does not weight password strength by their combination of upper/lower letters, special characters and...

xenforo.com

I was just going to recommend that addon. It surely does. If a breached password is found, it’ll alert the user.

 

[PumpinIron]

I've got several users asking to use 2FA. It's enabled under the user group permissions in the ACP, but when you go to the front end, then to password and security, all you see is this:




What am I missing?

 

[nodle]

I've got several users asking to use 2FA. It's enabled under the user group permissions in the ACP, but when you go to the front end, then to password and security, all you see is this:

View attachment 292411


What am I missing?

Look here I think it walks you through it.

Security | Manual | XenForo

End-user documentation for XenForo

xenforo.com

Two-factor authentication#​

Two factor authentication (2FA), or two-step verification, is an enhanced security system that requires users to provide an extra level of security when logging in to their accounts.

This may take the form of a code to be entered from an app such as Authy, Google Authenticator or the iCloud Password Manager, or clicking a link in an email sent to your users' registered email address etc.

The 2FA methods available in XenForo are listed at Setup > Service providers > Two-step verification.

 

[PumpinIron]

Look here I think it walks you through it.

Security | Manual | XenForo

End-user documentation for XenForo

xenforo.com

Yep, I saw that. Even with everything enabled the option still doesn't show up: