1

I am using Logintoboggan module but by chance by playing around with Wireshark packet sniffing tools I can see all login details and passwords when users login/register on my site!

Is there a way to encrypt login details and/ or add extra security to this module - Are there better secure modules out there?

  • 1
    I'm not 100% sure I understand what you mean, but wouldn't SSL prevent any kind of sniffing on the data sent/received from the website? – Aram Boyajyan Mar 2 '16 at 23:12
1

Secure Login

For sites that are available via both HTTP and HTTPS, Secure Login module ensures that the user login and other forms are submitted securely via HTTPS, thus preventing passwords and other private user data from being transmitted in the clear. Secure Login module locks down not just the user/login page but also any page containing the user login block, and any other forms that you configure to be secured.

For Drupal 7 and 8, Secure Login module enforces secure authenticated session cookies, thus preventing session hijacking. For previous versions of Drupal, PHP's session.cookie_secure flag must be enabled on the HTTPS site to enforce secure session cookies.

Login Security

With Login Security module, a site administrator may protect and restrict access by adding access control features to the login forms (default login form in /user and the block called "login form block"). Enabling this module, a site administrator may

limit the number of invalid login attempts before blocking accounts, or deny access by IP address, temporarily or permanently. A set of notifications by email or Nagios may help the site administrator to know when something is happening with the login form of their site:

password and account guessing, bruteforce login attempts or just unexpected behaviour with the login operation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.