Miscellaneous Hacks - Human Verification on Login

What is it?
----------------------------
This mod adds human verification to login, after a selectable number of failures (strikes).


Why would I want this? Users will hate it.
----------------------------
The idea is that attempts at account hacking by guessing passwords will fail if they are automated and not expecting the HV input. This will reduce the number of guesses per lockout period, and also since an incorrect or missing HV response does not count as a strike, your users will not get "lockout" emails. You can configure the mod so that HV input isn't required until a certain number of failures, so most of the time users won't even notice. Also, many users probably use "Remember Me" and so will never notice.


Note: This hasn't been tested with Forum Runner, Tapatalk, or anything similar. The mod attempts to disable itself for Forum Runner and Tapatalk, but this hasn't been tested. If you install this mod and you use one those on your forum, you should test it (for example, try logging in with incorrect password 4 times and make sure it works if you enter the correct password the 5th time). Also, I will appreciate any reports of problems or success.

Thanks to woodmj for ideas and testing.

Installation:
----------------------------
1) Import the product XML file from the Product Manager.

2) Go to Settings > Human Verification Options (in the options, not the human verification manager) to enable and configure.

You can select a different type of HV than you are using for other actions. For example, you might use some type of captcha for registration, but use Q&A for login. Note that you still have to use the Human Verification Manager to configure each type. So if you want to use Q&A for login, you would have to temporarily select it in the HV Manager to configure your questions. You can then re-select a different HV type for other actions if desired.

3) Test the mod in each of your styles. There is a field in the options for an ip address, and if this is filled in, the HV will only be active for that ip address, allowing testing without affecting other users. You can then clear the field when you are done testing.

Testing each style is important because the mod attempts to insert the HV template automatically, but if it can't (if you have custom styles for example) the mod will still be expecting the HV answer to be submitted, which will result in login failures. If this happens, the mod can still be used by manually editing the STANDARD_ERROR and mobile_login templates and inserting {vb:raw kh99_login_hv} after the password field.


History:
----------------------------
0.9 (Mar 19, 2015)

• Initial Release

[LOGECT]

Thanks for the Great Mod, works fine.

[woodmj]

@kh99 - Sorry to bother you but is there anyway I can get the mod to work with a custom theme of mine? It's basically a copy of the VB4 default theme with the colour scheme changed around.

[kh99]

Originally Posted by woodmj

@kh99 - Sorry to bother you but is there anyway I can get the mod to work with a custom theme of mine? It's basically a copy of the VB4 default theme with the colour scheme changed around.

So you've tried it and it doesn't work? Changing the color scheme shouldn't matter if the html is basically the same, but I can tell you how to edit the header and STANDARD_ERROR templates manually if you need to.

[woodmj]

Basically the custom theme just doesn't work anymore and comes up as the standard theme. I had just disabled all but the 2 default VB themes but 1 of my mods asked if I could get a particular theme back for him. No biggy if it's not possible or would cause a lot of work. Just thought I'd look into it.

[kh99]

Hmm, so are you saying this mod stopped one of your themes from working at all? That shouldn't happen. Or are you saying that it's just the HV that doesn't work with some of th themes? That we can fix.

[woodmj]

The style just stopped working. Not sure why. My board can be pretty flaky though.

[kh99]

Originally Posted by woodmj

The style just stopped working. Not sure why. My board can be pretty flaky though.

Well, does it work when this mod is disable, then stop working when you enable it? If so then there's some problem with this mod that I can try to figure out.

[woodmj]

@kh99 - Sorry for creating any confusion. It turned out the issue I had with my custom theme was related to VBOptimise. Once I had cleared it's cache all was fine and your mod worked fine.

[madness85]

Originally Posted by kh99

OK, I'll look in to it. It's probably something I didn't consider. So when you say it's closed to the public, what do you mean exactly? That all forums are set so that they're not visible to guests?

What do you have the stirkes set to? I guess 0 if you want to see it the first time?

Also, what do you mean about the admincp, is it when you go directly to the admincp and you're not logged in at all yet?

Hi buddy could my issues be fixed by simple template edit or is it going to be more complicated than that?

[kh99]

Originally Posted by madness85

Hi buddy could my issues be fixed by simple template edit or is it going to be more complicated than that?

I've actually fixed one of those issues, but it's the admincp that I'm still trying to work out. It doesn't use templates so I can't add the human verification the same way. But I think I can make it redirect to the other login page, I just haven't had a chance to try it yet.