IP check against brute force

Question

I want to prevent brute force by checking login attempter's IP. However it will be a huge problem for the database; it will overload in case of attack. Is there any other solution?

Server side session? Something like

$_SESSION['$IP'] = $_SESSION['$IP'] +1;

I don't want to use captcha because it is annoying.

Answer 1

In which terms in will overload the DB? You can maintain just one record per IP address with number of failed logins (cleared on successfull login). In the case the number reaches your trashhold you may block the account for an hour for example and maintain one filed with timestamp when the account was blocked. There is no need to log every attempt, right?

Answer 2

Sessions can't be relied on, if the attack is coming from a script it won't even support sessions. IP's can't be relied on since a script can constantly change its originating IP.

I made a class that takes care of brute force attack protection in PHP.

https://github.com/ejfrancis/BruteForceBlocker

it logs all failed logins site-wide in a db table, and if the number of failed logins in the last 10 minutes (or whatever time frame you choose) is over a set limit, it enforces a time delay and/or a captcha requirement before logging in again.

example:

//build throttle settings array. (# recent failed logins => response).

$throttle_settings = [

    50 => 2,            //delay in seconds
    150 => 4,           //delay in seconds
    300 => 'captcha'    //captcha 

];

$BFBresponse = BruteForceBlocker::getLoginStatus($throttle_settings);

//$throttle_settings is an optional parameter. if it's not included,the default settings array in BruteForceBlocker.php will be used

switch ($BFBresponse['status']){

case 'safe':
    //safe to login
    break;
case 'error':
    //error occured. get message
    $error_message = $BFBresponse['message'];
    break;
case 'delay':
    //time delay required before next login
    $remaining_delay_in_seconds = $BFBresponse['message'];
    break;
case 'captcha':
    //captcha required
    break;

}