What happens when a user tries to login several times and still fails?

[DYING_S0UL]

The title implies all. So what happened today was, I tried logging into my account but failed several time (3-4 tries). Probably because, the caps lock was on, or I pressed log in before solving the captcha, or the code got expired, simply put I wasn't being careful enough and it took me several attempts before I could successfully log in.

So my question is that, what happens when someone constantly tries logging in but still fails? Do they get some kind of temporary ban like "You cannot login your "XYZ" account before 15 Dec, 2025" (Like the ones we get when failing our phones's lock), or can we just try infinitely? This is just a curious question, popped into my mind when I faced this situation . Anyone knows the answer to that?

[Findingnemo]

AFAIK, nothing happens.

There is no limit on how many unsuccessful login attempts here, like we see on social media, internet banking. The only possibility of locking the forum account is clicking the link via the recovery mail or using the secret question.

[Charles-Tim]

If there would be a temporary ban because of several failed login attempts, we would know about it but there is nothing like that. So I think if you continue to use wrong password and not able to login, there is nothing that will happen.  But this can best be answered by the admin or moderator.

[DYING_S0UL]

AFAIK, nothing happens.

There is no limit on how many unsuccessful login attempts here, like we see on social media.

If there would be a temporary ban several failed login attempts, we would know about it but there is nothing like that. So I think if you continue to out wrong password, there is nothing that will happen.  But this can best be answered by the admin or moderator if they know about it.

Then isn't that concerning? I mean anyone can try to brute for the accounts if they ever wanted to! As for the captcha part, I saw somewhere on the internet that it too can be bypassed, a robot or an python script that seems to be solving the capcha on it's own!

Edit: I was referring to tools like these actually: https://www.youtube.com/watch?v=RGR5Xj0Qqfs or this https://www.youtube.com/watch?v=aF3ee0uTBm4

[PX-Z]

Nothing. But the captcha code gets harder and harder, or will take so many times, well, at least in my experience, that's why using the captcha bypass helps a lot, also idk about TOR users still have captcha.

Also, if i tried so many failed attempt, best thing to do is to reset password lol.

[Charles-Tim]

Then isn't that concerning? I mean anyone can try to brute for the accounts if they wanted! As for the captcha part, I saw somewhere on the internet that it too can be bypassed, a robot or an script that seems to be solving the capcha on it's own!

The captcha can not be bypassed by a stranger, that is not possible. The stranger will need to have the person's captcha bypass link before he can be able to bypass the captcha.

Also people are not complaining about their account being hijacked. If any account is hijacked by a hacker, the reason is not because of this. It is not as easy as you think.

[tbct_mt2]

AFAIK, nothing happens.

There is no limit on how many unsuccessful login attempts here, like we see on social media, internet banking.

You can not generalize too much like this as on different platforms, different things happen. With banks, internet banking and bank accounts, as far as I know, if you made several failed log in attempts, like 5 attempts, your bank account can be locked. You will need to go to that bank in order to unlock your account, and change your bank account password.

The only possibility of locking the forum account is clicking the link via the recovery mail or using the secret question.

PSA: ACCOUNTS WILL BE LOCKED IF THE SECRET QUESTION IS USED TO RECOVER IT

[DYING_S0UL]

Nothing. But the captcha code gets harder and harder, or will take so many times, well, at least in my experience, that's why using the captcha bypass helps a lot, also idk about TOR users still have captcha.

I wasn't aware captcha worked like this, that they have protection levels! TOR is a mess when it comes to captcha, I'm not considering that option.

The captcha can not be bypassed by a stranger, that is not possible. The stranger will need to have the person's captcha bypass link before he can be able to bypass the captcha.

Also people are not complaining about their account being hijacked. If any account is hijacked by a hacker, the reason is not because of this. It is not as easy as you think.

Check the Youtube link above! They seems to be bypassing cloudflare somehow! Obviously I'm not an expert on this, but it is what it was, and is possible.

People complaining isn't the main subject, and as I said originally the topic was curiosity intended, I just wanna know, the outcome! The hacking part comes later, and in case of compromises we have signed messages!

...

The only possibility of locking the forum account is clicking the link via the recovery mail or using the secret question.

PSA: ACCOUNTS WILL BE LOCKED IF THE SECRET QUESTION IS USED TO RECOVER IT

Again this is not what I asked. I am aware of self banning method. But the topic isn't about that.

[Findingnemo]

~
Then isn't that concerning? I mean anyone can try to brute for the accounts if they ever wanted to! As for the captcha part, I saw somewhere on the internet that it too can be bypassed, a robot or an python script that seems to be solving the capcha on it's own!

The market for bitcointalk accounts is almost null. Even if someone successfully managed to login with an active user profile then it is possible that the suspicious activity will be noticed by the community members and can be reported and once the real owner realizes the unauthorized login they can recover the account in any possible ways.

[promise444c5]

also idk about TOR users still have captcha.

Yes.. the Captcha is still there unless you mean the captcha_code  for bypass, which is also available…

[EarnOnVictor]

So my question is that, what happens when someone constantly tries logging in but still fails? Do they get some kind of temporary ban like "You cannot login your "XYZ" account before 15 Dec, 2025" (Like the ones we get when failing our phones's lock), or can we just try infinitely? This is just a curious question, popped into my mind when I faced this situation . Anyone knows the answer to that?

This is why Bitcointalk is unique: "nothing will happen."

I've not had too many failed attempts before, but I'm sure that I've had it more than 3 times when I wanted to log in to my mobile phone, and nothing like a ban error was displayed due to failed attempts.

I think this is unique to lessen the burden on users. The person who forgot it now can easily remember it later.

[Charles-Tim]

I wasn't aware captcha worked like this, that they have protection levels! TOR is a mess when it comes to captcha, I'm not considering that option.

Tor may slowly load the captcha but once it loads, it is simple to solve, unlike the former reCaptcha, hCaptcha is easy to solve.

Check the Youtube link above! They seems to be bypassing cloudflare somehow! Obviously I'm not an expert on this, but it is what it was, and is possible.

There may be vulnerabilities but not yet seen. It is not bad to be unable to login for some hours after something like 5 failed attempts. But with how the system is right now, this is not a problem.

[Donneski]

As much as I know, nothing happens when you enter the wrong password a several times on Bitcointalk. The forum won’t lock your account or hit you with a "try again in 24 hours” type of ban. At worst, you might get a brief slowdown or another captcha but that’s all about it.

The login page is pretty forgiving as long as you eventually enter the right details, you'll be good to go again.

[SamReomo]

Then isn't that concerning? I mean anyone can try to brute for the accounts if they ever wanted to! As for the captcha part, I saw somewhere on the internet that it too can be bypassed, a robot or an python script that seems to be solving the capcha on it's own!

No, it isn't concerning because it's not easy to brute force the accounts especially when the captcha is present. Well, it's possible to bypass it but that will make brute forcing slow and thus there won't be any outcome of such attack.

When it comes to Python script that solves captcha then such isn't going to be any useful here. Now there's also two factor authentication available and that pretty much makes brute forcing useless whatsoever.

[LoyceV]

This makes me believe there is no limit other than "1 page request per second on average":

If someone else gains access to your unique captcha-bypass link, then they could try to brute-force your password.

And that's a good thing: I wouldn't want to be banned because someone else tries to brute-force my account!

[virasog]

If there would be a temporary ban because of several failed login attempts, we would know about it but there is nothing like that. So I think if you continue to use wrong password and not able to login, there is nothing that will happen.  But this can best be answered by the admin or moderator.

The reason for not getting the account locked after some unsuccessful attempts can be that it could be misused. Like anyone can try login anyone account by wrong passwords and then get his account locked or temporary ban (as some user was suggesting this too).

By the way, do we get an email to our registered email address that our account was attempted to login but unsuccessful ? That would be helpful to know if someone is trying constantly to login and trying with random passwords to any account.

[DYING_S0UL]

The market for bitcointalk accounts is almost null.

snip...

Yet everyday we see bunch of hacked/bought accounts being reported in the reputation board. So I wouldn't call that almost null.

When it comes to Python script that solves captcha then such isn't going to be any useful here. Now there's also two factor authentication available and that pretty much makes brute forcing useless whatsoever.

LOL, I almost forgot about the 2FA fetaure. Well in any cases, most users are safe I guess, but for old inactive high ranked abandoned accounts, there is still a scope! Won't you agree?

This makes me believe there is no limit other than "1 page request per second on average":

If someone else gains access to your unique captcha-bypass link, then they could try to brute-force your password.

And that's a good thing: I wouldn't want to be banned because someone else tries to brute-force my account!

New day, new things to learn! I wasn't aware of this 1 second rule!  

Didn't mean like an actual ban but stopping an user from logging in for a couple of hours or a day or two!

By the way, do we get an email to our registered email address that our account was attempted to login but unsuccessful ? That would be helpful to know if someone is trying constantly to login and trying with random passwords to any account.

I don't think we do! I believe I have never gotten such emails from btt forum.
Btw this seems like an useful feature! Again we have signed message and other ways to recover an account, but sometimes that can be a hassle for many, an early warning system is indeed helpful (like the ones we get from google, facebook etc).

[LoyceV]

New day, new things to learn! I wasn't aware of this 1 second rule!  

"Normal" users shouldn't even notice it, but it's good to know when running scrapers. Or if you quickly want to open 30 links in background tabs.

[Mia Chloe]

The title implies all. So what happened today was, I tried logging into my account but failed several time (3-4 tries). Probably because, the caps lock was on, or I pressed log in before solving the captcha, or the code got expired, simply put I wasn't being careful enough and it took me several attempts before I could successfully log in.

Well actually nothing happens which is why you have a captcha to avoid someone from brute forcing your password. This simply means if someone is able to guess it via a couple of tries then you are either at fault for putting up a weak password or that person knows a couple things about you to a nice extent to be able to guess your password.

If you want to safe guard your account I will recommend you never use that captcha bypass link because it's the only way your account can be brute forced.

[Amphenomenon]

The market for bitcointalk accounts is almost null.

snip...

Yet everyday we see bunch of hacked/bought accounts being reported in the reputation board. So I wouldn't call that almost null.

I can say most of these accounts are either sold or password got compromised one way to another and not majorly through brute forcing because we could have been seeing much post even until now about this.

Didn't mean like an actual ban but stopping an user from logging in for a couple of hours or a day or two!

I think this might not be so much necessary to do, especially giving a timeout for day(s), because  a user are having an issue accessing their account and I get attackers can still make of use but the system recovery method is still effective and there is a method to identify the actual owner of an account which is through them signing a message with their bitcoin address.