Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Send an email / text when there is a fail login attempt #9140

Open
tsteur opened this issue Nov 1, 2015 · 12 comments
Open

Send an email / text when there is a fail login attempt #9140

tsteur opened this issue Nov 1, 2015 · 12 comments
Labels
c: New plugin For features that probably will not be added to Matomo, but could be implemented as plugins. c: Security For issues that make Matomo more secure. Please report issues through HackerOne and not in Github.
Milestone
Backlog (Help wan...

Comments

@tsteur
Copy link
Member

tsteur commented Nov 1, 2015

We should at least optionally notify a user when there is a failed login attempt. I'd have it enabled by default in core but we could also have it as a plugin on the marketplace or by default disabled.

We'd send an email to the owner of the account letting the user know someone tried to log in using his login name. Maybe we'd also add IP address etc? I'm sure there are many examples for this on the internet.

We could also only send it after the second or third failed attempt.

It is a bit related to brute force attack but not really: #2888
@tsteur tsteur added the c: Security For issues that make Matomo more secure. Please report issues through HackerOne and not in Github. label Nov 1, 2015
@tsteur tsteur mentioned this issue Nov 1, 2015
Closed
@mattab
Copy link
Member

mattab commented Nov 2, 2015

Nice idea! Maybe a good idea as a first step before #2888

@hpvd
Copy link

hpvd commented Nov 2, 2015

sound's great!
maybe one should think of sending this mail not always but only after e.g. 3rd failed login attempted?

@hpvd
Copy link

hpvd commented Nov 2, 2015

on the other hand one could extend this to send a mail when some logs in from an other country than the last time (or similar)?

@hpvd
Copy link

hpvd commented Nov 2, 2015

putting the IP in the email would be great - maybe one could reuse geoIP feature

@gaumondp
Copy link

gaumondp commented Nov 2, 2015

We'd send an email to the owner of the account letting the user know someone tried to log in using his login name.

I think superadmin/admin should be made aware too... There's something "fishy" after more than 5 attempts...

@tsteur tsteur added the c: New plugin For features that probably will not be added to Matomo, but could be implemented as plugins. label Nov 2, 2015
@tsteur
Copy link
Member Author

tsteur commented Nov 2, 2015

Good point re other country. I'll create a separate issue for this. They might be developed both in one step at some point but better to have them separated.

@tsteur tsteur mentioned this issue Nov 2, 2015
Open
@tsteur
Copy link
Member Author

tsteur commented Nov 5, 2015

If text messages are configured in a Piwik (eg for scheduled reports) one should ideally also be able to receive it as a text message on your phone to be able to react quickly in case it wasn't you who tried to log in...

@tsteur tsteur changed the title Send an email when there is a fail login attempt Send an email / text when there is a fail login attempt Nov 5, 2015
@mattab
Copy link
Member

mattab commented Nov 26, 2015

I think #2888 is more valuable first (althrough of course also more complicated to implement)

@mattab mattab added this to the Mid term milestone Nov 26, 2015
@mattab mattab modified the milestones: Long term, Mid term Dec 5, 2016
@mattab mattab modified the milestones: Backlog (Help wanted), 3.7.0 Jun 20, 2018
@tsteur
Copy link
Member Author

tsteur commented Sep 21, 2018

Just FYI: When an attacker brute forces tokens, no user can be notified as there is only the token and no username. As an attacker, I would not bother about trying to log in through username/password but instead through the API which also avoids needing the nonce etc.

Maybe a simple solution for #2888 is more useful for now?

@tsteur
Copy link
Member Author

tsteur commented Sep 21, 2018

Just seeing #2888 is scheduled for 3.7.0 as well :)

@tsteur
Copy link
Member Author

tsteur commented Oct 4, 2018

FYI: Now that we will have #2888 I will move it out of this milestone. It wouldn't be that valuable when a user can still try to log in through token_auth and basically nobody would get notified. Also it could result in heaps of mails.

@tsteur tsteur modified the milestones: 3.7.0, Backlog (Help wanted) Oct 4, 2018
@NinjaZMY
Copy link

hey guys , is there a way to report an ip address that tried to access , my account ?

the login attempt happened , just after my :

user.device_verification_requested | user.login | user.device_verification_success!

Is there a way that the attacker , tracked my "user.device_verification_success"

cause the attack happened at the same day , just after I did , the "user.device_verification_success"

Is there a Way to Resolve this ? .... & thanks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
c: New plugin For features that probably will not be added to Matomo, but could be implemented as plugins. c: Security For issues that make Matomo more secure. Please report issues through HackerOne and not in Github.
Projects
None yet
Milestone
Backlog (Help wanted)
Development

No branches or pull requests
5 participants
@tsteur @mattab @hpvd @gaumondp @NinjaZMY