limit password logins to 3 per hour per account

liberapay/constants.py

@@ -198,6 +198,7 @@ def check_bits(bits):
     'log-in.email': (10, 60*60*24),  # 10 per day
     'log-in.email.not-verified': (2, 60*60*24),  # 2 per day
     'log-in.email.verified': (10, 60*60*24),  # 10 per day
+    'log-in.password': (3, 60*60),  # 3 per hour
 }
 
 SEPA = set("""

liberapay/exceptions.py

@@ -149,6 +149,14 @@ def msg(self, _):
             "or contact [email protected]."
         )
 
+class TooManyPasswordLogins(LazyResponseXXX):
+    code = 429
+    def msg(self, _):
+        return _(
+            "There have been too many attempts to log in to this account recently, "
+            "please try again in a few hours or log in via email."
+        )
+
 
 class BadPasswordSize(LazyResponse400):
     def msg(self, _):

liberapay/security/authentication.py

@@ -7,7 +7,7 @@
 from pando import Response
 
 from liberapay.constants import SESSION, SESSION_TIMEOUT
-from liberapay.exceptions import LoginRequired, TooManyLoginEmails
+from liberapay.exceptions import LoginRequired, TooManyLoginEmails, TooManyPasswordLogins
 from liberapay.models.participant import Participant
 
 
@@ -42,6 +42,7 @@ def sign_in_with_form_data(body, state):
         password = body.pop('log-in.password', None)
         k = 'email' if '@' in id else 'username'
         if password:
+            website.db.hit_rate_limit('log-in.password', k, TooManyPasswordLogins)
             p = Participant.authenticate(
                 k, 'password',
                 id, password,