The current version of SilverlightDesktop implements security by assigning a temporary password to the user when they launch the Silverlight application. This password is passed to the Silverlight application through the InitParameter. The SilverlightDesktop application uses this password when communicating with the web services.
Then we had a thought. What if you wanted to guess the passwords on a SilverlightDesktop site? You know the temporary password is always a number. Yes it is a large number, but you could write a program that sat there all day trying one number after another.
To combat this we decided to implement a count of bad password attempts. After a certain amount of attempts the account would be locked. The problem with this is that your could shut down a site by intentionally sending bad passwords and locking out accounts with known user names.
The solution is to store the IP Address as well as th ...