The TWX login system is not secure enough (according to client)

[zyuan1]

The TWX login system is not secure enough (according to client)

Client mentioned that they can use Brute Force attack to find out the password of the User, although I explained with "length limit","blacklist","user lock" it won't be that easy to hack the User.

The client suggests TWX adding a new field during User login [ popup login or FormLogin], in this field we type in the random number we read from a picture the system generates, and it will change everytime we try to login. This is a common secure mechnism in China to avoid 

[olivierlp]

PTC strongly recommends that customers use Single Sign-On (SSO) to authenticate to ThingWorx, and will thus focus R&D efforts on enhancing that capability. Additionally, customers using Basic or Form authentication can limit the number of login attempts (defaulting to 5) within a certain period (defaulting to 5 minutes), which will make a brute force attack such as the one described almost impossible.