# Security measures proposal - User login brute force prevention, and more

**URL:** <https://meta.discourse.org/t/security-measures-proposal-user-login-brute-force-prevention-and-more/19023>\
**Category:** Feature\
**Created:** [19 Agosto 2014, 12:42am UTC](https://meta.discourse.org/t/security-measures-proposal-user-login-brute-force-prevention-and-more/19023 "2014-08-19T00:42:23Z")\
**Posts on this page:** 1\
**Showing post:** 12

<div class="post-metadata">

**Author:** ![fysics](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/fysics/32/34080_2.png) [@fysics](https://meta.discourse.org/u/fysics)\
**Post date:** [9 Settembre 2014, 1:12am UTC](https://meta.discourse.org/t/security-measures-proposal-user-login-brute-force-prevention-and-more/19023/12 "2014-09-09T01:12:46Z")

</div>

> [@michaeld](#):
>
> This is not a good idea, because it’s a very easy denial of service against an account. Lockouts should never be on an account, but on an IP address.

👍

Another thing, continuing a little bit from [this](https://meta.discourse.org/t/reset-password-doesnt-give-password-requirements/19799) topic: It has always irked me (not in Discourse, but elsewhere) when I forget my password, but I’m also unaware what the original password requirements were, so I don’t know what I would have chosen as my password. I then do a password reset, am reminded of the requirements, and end up choosing the same password I had originally.

Displaying the password requirements after the second or third failure would be a nice feature. It doesn’t detract from security, because password requirements are not fundamentally sensitive (i.e. they are displayed to all new registrants).

---

_[View the full topic](https://meta.discourse.org/t/security-measures-proposal-user-login-brute-force-prevention-and-more/19023)._