{"action":"created","issue":{"url":"https://api.github.com/repos/Xephi/AuthMeReloaded/issues/764","repository_url":"https://api.github.com/repos/Xephi/AuthMeReloaded","labels_url":"https://api.github.com/repos/Xephi/AuthMeReloaded/issues/764/labels{/name}","comments_url":"https://api.github.com/repos/Xephi/AuthMeReloaded/issues/764/comments","events_url":"https://api.github.com/repos/Xephi/AuthMeReloaded/issues/764/events","html_url":"https://github.com/Xephi/AuthMeReloaded/issues/764","id":160002888,"number":764,"title":"Implement resetting tempban count after a time","user":{"login":"Gnat008","id":5157277,"avatar_url":"https://avatars.githubusercontent.com/u/5157277?v=3","gravatar_id":"","url":"https://api.github.com/users/Gnat008","html_url":"https://github.com/Gnat008","followers_url":"https://api.github.com/users/Gnat008/followers","following_url":"https://api.github.com/users/Gnat008/following{/other_user}","gists_url":"https://api.github.com/users/Gnat008/gists{/gist_id}","starred_url":"https://api.github.com/users/Gnat008/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Gnat008/subscriptions","organizations_url":"https://api.github.com/users/Gnat008/orgs","repos_url":"https://api.github.com/users/Gnat008/repos","events_url":"https://api.github.com/users/Gnat008/events{/privacy}","received_events_url":"https://api.github.com/users/Gnat008/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/Xephi/AuthMeReloaded/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2016-06-13T17:26:45Z","updated_at":"2016-06-13T19:39:34Z","closed_at":null,"body":"Currently the tempban counter will only be reset on a successful login and (I presume) a server restart. This means that a user can attempt to log in to his own account and fail x times, and that count will never be reset. Worse, an attacker can log in incorrectly without hitting the tempban threshold, potentially allowing the account's legitimate owner to be tempbanned should he make a typo in his password.\r\n\r\nPerhaps after a time the counter should be reset, likely after the user leaves the server. This time will have to be long enough to severely discourage brute-force attacks, however.\r\n\r\nAnother solution to look into might be to use the player's IP instead of the name as the key for the counter? But then that opens the door to restarting their modem, getting a new IP, and another bunch of tries, so I guess that isn't viable after all."},"comment":{"url":"https://api.github.com/repos/Xephi/AuthMeReloaded/issues/comments/225685660","html_url":"https://github.com/Xephi/AuthMeReloaded/issues/764#issuecomment-225685660","issue_url":"https://api.github.com/repos/Xephi/AuthMeReloaded/issues/764","id":225685660,"user":{"login":"ljacqu","id":8417009,"avatar_url":"https://avatars.githubusercontent.com/u/8417009?v=3","gravatar_id":"","url":"https://api.github.com/users/ljacqu","html_url":"https://github.com/ljacqu","followers_url":"https://api.github.com/users/ljacqu/followers","following_url":"https://api.github.com/users/ljacqu/following{/other_user}","gists_url":"https://api.github.com/users/ljacqu/gists{/gist_id}","starred_url":"https://api.github.com/users/ljacqu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ljacqu/subscriptions","organizations_url":"https://api.github.com/users/ljacqu/orgs","repos_url":"https://api.github.com/users/ljacqu/repos","events_url":"https://api.github.com/users/ljacqu/events{/privacy}","received_events_url":"https://api.github.com/users/ljacqu/received_events","type":"User","site_admin":false},"created_at":"2016-06-13T19:39:34Z","updated_at":"2016-06-13T19:39:34Z","body":"If you could, that would be lovely! Then we can set #192 as verifiable :smile:"}}
{"actor":{"display_login":"ljacqu"}}