Throttling logins

[ExactObject]

Apologies if suggested before but I seem to recall there was a throttling system in the past to deter spambot login attacks. If that can be brought back, it would be great.

[JeromSar]

@markbyrn There's currently only a spam messaging throttle. If you want to rate logins from a single IP, that could be added as well. We could also impose some smart heuristics to detect possible spambot attacks (multiple accounts with long random-like names, joining and quiting in great succession, etc).

Let me know what your thoughts are. :)

P.S. I think you might be talking about BukkitTelnet. BukkitTelnet has a system to limit telnet spam attacks.

[lemonsked]

We used to have some message along the lines of "Connection throttled! Please wait before reconnecting"
Spigot had it, and I think you need to edit bukkit.yml or spigot.yml for it

[JeromSar]

@OxLemonxO Ahhh, yes, Spigot does have that feature, but I don't like the way it works. I'd rather implement a smarter (and probably better) anti-spambot feature.

[ExactObject]

smart detection is great if it can be done but at least something that detects a massive number of logins at once and auto-throttles to X seconds per login.

[mayokek]

A similar issue - #1437

[JeromSar]

I've started implementing anti spambot features in 873e839