enable reCAPTCHA after 3 login attempts and on forgot password page?

Question

using a simple automated script someone can try to hack account by entering various password attempt so do you think its good idea to enable reCAPTCHA after 3 login attempt?

I feel reCAPTCHA should be by default enabled on forgot password page. for testing I tried forgot password 10 time and received 10 emails. so if someone want to really bother user he may just use this option.

just a security concerns.

Answer 1

I will add reCAPTCHA to the forgot password page in the 1.0 release. As for preventing brute force attacks to discover someone's password, I will do something about this if there's enough demand.

Comments

Thanks! brute force is common on popular sites to hack accounts. you can implement this security feature depending on your priority and demand.

btw, you can also lock user account for 15 or 30 min after 5 login attempts.