TallyMan wrote:
A clever thing that could have been done with the program code is to only ask for the security code for members with say less than ten posts instead of hitting everyone with the security code. Not many spammers make it to ten or more posts! Though this would make the login two part as it would have to get the username first.
Actually, a multi-screen login process can increase security, as well. For example, my credit union has a 2-3 phase login process (depending on if it recognizes your computer or not) and has somewhat of a 2 phase authentication. It is also designed to stop faudulent attempts, as it doesn't give a pass/fail until the last step. Step 1 asks for member number, and checks if your browser has a cookie with appropriate info. If the cookie isn't there, it gives a prompt asking for a piece of info that those close would know, but a random person wouldn't. Also, it asks if it is a public computer, so it knows if it should set the cookie on a successful login. After this screen, it takes you to the screen for the password. On this screen, there is also an image and security word presented to confirm you are at the site. If your member number and answer to the security question don't match, the image presented will be a random image and security word presented. You pick your image from about 100 on their site, and set the security word for it to present. If you don't recognize the image and security word as yours, you don't enter the password. If you do, you enter your password. There is a link on this page also to take you back to the beginning if you don't recognize the image/word combination (in case of a typo). The intermediate pages in the login process are very simple pages, so take minimal time to load, even on the slowest of internet connections.