|
well, i usually log ips and attach them to the usernames. if the ip changes constantly, i simply lock the account and send out an email for a verification.. simple and easy. With this, the limit is the sky, for example, use geo location, so if the user is originally from Germany, and it suddenly logs in from the US, lock the account immediately. you don't want to get annoying with locking, but there are different scenarios which clearly shows if an account is leaked or not. I also do web searches from time to time to see if any of my users have their credentials leaked. if so, I do the locking manually and contact the users directly.
__________________
php, html, jquery, javascript, wordpress - contact me at contact at zerovic.com
|