Security settings: blocking repeated failed sign-ins, call limits, and web lockout.
A phone system on the internet gets knocked on all day by strangers. Within hours of a server going online, something is trying extension numbers and passwords against it.
Blocking
Pidgin Talk now counts failed sign-ins and blocks an address that keeps getting it wrong: too many wrong passwords, or too many requests with no valid credentials in a minute. A real phone sends one request per registration or call. A scanner sends hundreds.
A blocked address gets no reply at all. Not a refusal, nothing. To the scanner, the server has simply gone dark.
The page lists what is blocked right now and can let an address back in.
Not blocking the wrong people
Blocking by address has a trap: a sender can lie about where a request came from. So a wrong password only counts when the request answered one of our own challenges, which can only have reached the real sender. Trusted networks and the providers' own servers are never blocked.
Limits
| Limit | What it stops |
|---|---|
| Calls at once, system-wide | A flood taking every line |
| Calls at once, per extension | One phone or stolen account hogging the system |
| Outside calls per hour, per extension | Toll fraud running up a bill overnight |
| Failed web sign-ins | Guessing an administrator's password |
A call refused by a limit is logged as exactly that, so it is never mistaken for a fault.
One page
Every one of these is adjustable in one place. The defaults assume the system is reachable from the internet and that someone is trying. In our experience, someone always is.