I’ve had locks on this site, the biggest one being .htaccess so only someone with a certain IP address can access the login form. In theory this would be a great idea — if I were the person with the right IP address. What’s happened usually is that I’m connected via a different bank of servers on my ISP, so whenever I’ve tried logging in to this blog, I’ve been blocked for arriving from the wrong place.
That’s fixable. I can go in and edit the .htaccess file each time to get in, but it’s a pain and it’s not always easy to do if you’re at the wrong computer. So now I’m trying Clef.
Clef’s big advantage, for me, is that I should be able to disable the standard login form. People can try guessing the password for the site, but it should be pointless now as there isn’t one. Instead there’s a one-use barcode that gets verified by my phone. There are a couple of downsides though.
First, I’m guessing it means I can’t log in to my site on my phone, because I can’t point my phone’s camera at my own screen, but I hate blogging on a phone anyway. The other is that if I log in over 10,000 times in a month that’s going to cost me 1¢ a login, I think. That would be one login every five minutes for a month, assuming I don’t sleep.
I’ll be interested to see how this works in stopping all the break in attempts.