I will host very sensitive data on my app ( even this won't be the case it is good to have the safest scenario possible 🙂 ).
I was thinking of putting in place this scenario:
- login using the default login page, complemented with No Captcha ReCaptcha
- IP blocking after 2 attempts
- once logged-in an other login page will show-up ( may be a big pop-up )
- a security question will ask the user to enter to correct answer
- in case of failure user will be logged-out and won't be able to see any data
Any ideas ?