{"action":"created","issue":{"url":"https://api.github.com/repos/matomo-org/matomo/issues/2888","repository_url":"https://api.github.com/repos/matomo-org/matomo","labels_url":"https://api.github.com/repos/matomo-org/matomo/issues/2888/labels{/name}","comments_url":"https://api.github.com/repos/matomo-org/matomo/issues/2888/comments","events_url":"https://api.github.com/repos/matomo-org/matomo/issues/2888/events","html_url":"https://github.com/matomo-org/matomo/issues/2888","id":37353402,"node_id":"MDU6SXNzdWUzNzM1MzQwMg==","number":2888,"title":"Lock down accounts by IP after N failed attemps at logging","user":{"login":"mattab","id":466765,"node_id":"MDQ6VXNlcjQ2Njc2NQ==","avatar_url":"https://avatars3.githubusercontent.com/u/466765?v=4","gravatar_id":"","url":"https://api.github.com/users/mattab","html_url":"https://github.com/mattab","followers_url":"https://api.github.com/users/mattab/followers","following_url":"https://api.github.com/users/mattab/following{/other_user}","gists_url":"https://api.github.com/users/mattab/gists{/gist_id}","starred_url":"https://api.github.com/users/mattab/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mattab/subscriptions","organizations_url":"https://api.github.com/users/mattab/orgs","repos_url":"https://api.github.com/users/mattab/repos","events_url":"https://api.github.com/users/mattab/events{/privacy}","received_events_url":"https://api.github.com/users/mattab/received_events","type":"User","site_admin":false},"labels":[{"id":112370560,"node_id":"MDU6TGFiZWwxMTIzNzA1NjA=","url":"https://api.github.com/repos/matomo-org/matomo/labels/Enhancement","name":"Enhancement","color":"bfd4f2","default":false},{"id":112370553,"node_id":"MDU6TGFiZWwxMTIzNzA1NTM=","url":"https://api.github.com/repos/matomo-org/matomo/labels/Major","name":"Major","color":"eb6420","default":false},{"id":112370581,"node_id":"MDU6TGFiZWwxMTIzNzA1ODE=","url":"https://api.github.com/repos/matomo-org/matomo/labels/c:%20Security","name":"c: Security","color":"fad8c7","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/matomo-org/matomo/milestones/109","html_url":"https://github.com/matomo-org/matomo/milestone/109","labels_url":"https://api.github.com/repos/matomo-org/matomo/milestones/109/labels","id":2593479,"node_id":"MDk6TWlsZXN0b25lMjU5MzQ3OQ==","number":109,"title":"3.7.0","description":"","creator":{"login":"mattab","id":466765,"node_id":"MDQ6VXNlcjQ2Njc2NQ==","avatar_url":"https://avatars3.githubusercontent.com/u/466765?v=4","gravatar_id":"","url":"https://api.github.com/users/mattab","html_url":"https://github.com/mattab","followers_url":"https://api.github.com/users/mattab/followers","following_url":"https://api.github.com/users/mattab/following{/other_user}","gists_url":"https://api.github.com/users/mattab/gists{/gist_id}","starred_url":"https://api.github.com/users/mattab/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mattab/subscriptions","organizations_url":"https://api.github.com/users/mattab/orgs","repos_url":"https://api.github.com/users/mattab/repos","events_url":"https://api.github.com/users/mattab/events{/privacy}","received_events_url":"https://api.github.com/users/mattab/received_events","type":"User","site_admin":false},"open_issues":79,"closed_issues":5,"state":"open","created_at":"2017-06-20T11:57:22Z","updated_at":"2018-09-21T10:45:25Z","due_on":"2018-12-15T08:00:00Z","closed_at":null},"comments":32,"created_at":"2012-01-26T23:04:10Z","updated_at":"2018-09-21T21:27:59Z","closed_at":null,"author_association":"MEMBER","body":"Our security policy aims to make security a principal design behind Piwik. One aspect that bugs me currently is that good old brute force attacks could be vector of penetration in Piwik (if eg. attacker knows the login).\n\nWe should provide a core mechanism that would lock out, for  30min for example, a user after N failed attemps. Settings could be changed by the Super User and feature would be enabled by default, lock 30 min out after 5 failed attempts.\n\nImplementation proposal:\n- Record, using Piwik_SetOption, count of lockdown for each IP that fails to enter valid login / pwd combination\n- After N failures, lock IP down and refuse authentication (even if the combination is actually valid!).\n- Document as FAQ, linked from UI, the sql to delete all locked out IPs in case the SU was actually locked out and can't wait.\n"},"comment":{"url":"https://api.github.com/repos/matomo-org/matomo/issues/comments/423675596","html_url":"https://github.com/matomo-org/matomo/issues/2888#issuecomment-423675596","issue_url":"https://api.github.com/repos/matomo-org/matomo/issues/2888","id":423675596,"node_id":"MDEyOklzc3VlQ29tbWVudDQyMzY3NTU5Ng==","user":{"login":"mattab","id":466765,"node_id":"MDQ6VXNlcjQ2Njc2NQ==","avatar_url":"https://avatars3.githubusercontent.com/u/466765?v=4","gravatar_id":"","url":"https://api.github.com/users/mattab","html_url":"https://github.com/mattab","followers_url":"https://api.github.com/users/mattab/followers","following_url":"https://api.github.com/users/mattab/following{/other_user}","gists_url":"https://api.github.com/users/mattab/gists{/gist_id}","starred_url":"https://api.github.com/users/mattab/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mattab/subscriptions","organizations_url":"https://api.github.com/users/mattab/orgs","repos_url":"https://api.github.com/users/mattab/repos","events_url":"https://api.github.com/users/mattab/events{/privacy}","received_events_url":"https://api.github.com/users/mattab/received_events","type":"User","site_admin":false},"created_at":"2018-09-21T21:27:59Z","updated_at":"2018-09-21T21:27:59Z","author_association":"MEMBER","body":"Blocked as well"}}
{"actor":{"display_login":"mattab"}}