Take the 2-minute tour ×  If I save the time of first logging
attempt and if the 10th attempt is made in less than 1 minute
and I ban the IP address would that be enough to stop brute
force attack and ddos? In real life example will it be possible
for a user to enter the wrong address more than 10 times in a
minute?  EDIT: maybe I didn't put the question in right way,
would blocking the user/ip after 10 req/m make the system much
more secure, than standard block after 10 wrong attempts?
share|improve this question No, I think not. –  HAL9000 Jun 3
'13 at 10:16 For making a thing secure Nothing would be enough.
You should think how much is it important. (how much your site
is important and would have enemies). –  imsiso Jun 3 '13 at
10:16 It won't do you much good against DDOS attacks. –  Lidor
Jun 3 '13 at 10:17 And don´t block an ip, that´s not a good
approach... –  luk2302 Jun 3 '13 at 10:18 banning Ip address is
not a good idea. You can ban the login details. –  pinku Jun 3
'13 at 10:19 show 6 more commen