4 ms·
I'm bored with the brute force attack prevention argument. Why not just help your users out by throttling requests after N attempts? With throttling, "strong"
by ShabbyDoo 17y ago
I'm bored with the brute force attack prevention argument. Why not just help your users out by throttling requests after N attempts?
With throttling, "strong" password requirements (non-alpha, etc.) serve only to force users not to pick passwords obvious to someone who might know them (wife's name, etc.). That and avoiding the "letmein" cases, I guess.
- Retric 17y agoIt simplifies denial of service attacks, unless it's per IP, in which case a bonnet can try a few million passwords a day.
- ShabbyDoo 17y agoI was thinking about limiting the number of password attempts per time interval by user -- not the total number of attempts at any user's password per interval. Does that fix the DOS concern? In the RockYou case, a botnet could try 32M * # allowed/day given that it had a user list.
- Retric 17y agoWith a large user list, some people will have really terrible passwords. So my guess would be by trying random week passwords to random accounts you could compromise a few hundred accounts in the first day. With diminishing returns over time.
- ShabbyDoo 17y agoSo, the user list would have to be available/harvestable? I guess this is an argument for having separate login Ids and published usernames. So, one couldn't just spider a site to create a user list.
- roundsquare 17y agoEven if it doesn't solve the problem, seems like it would help. In this case, a user would need to have a "very weak" password to be compromised. "Somewhat weak" passwords would be fine. Also, after 100 or so attempts to login, I would thinking locking the user out would be fine (at least in many systems).
- Retric 17y agoThat recreates the ability to lock people out of the system once you know their user ID. Edit: However, a useful option is to force people to use a captia after a few bad atempts.
- euroclydon 17y agoWhy not just lock out a user after n failed login attempts?
- ShabbyDoo 17y agoAs long as there's a reasonable way to unlock a user. For a free consumer site, it can't require human interaction. "Email me a new password" seems reasonable for most cases.
- sorbits 17y agoI have a common four character name as login with Apple’s developer connection. I regularly get locked out (and have to request a new password) presumably because other users try to login to my account (not remembering their real login). This scheme sucks! Perhaps a better scheme would be to ban the IP for 10 minutes after half a dozen failed logins.
- DougBTX 17y agoIt makes it easy for someone to launch a denial-of-login attack, just set a script to log in with n random passwords, then the user won't be able to log in. With a rate limit, once the attack is over or blocked, the user can log in. With a ban after n, they would have to manually reset their password after each attack, which could be set to happen eg once an hour. Not that I've ever knowingly heard of someone getting attacked in such a way.
- euroclydon 17y agoWow, but if an attacker had a bunch of your user's usernames, that would be a major way for them to damage your site.
- thechangelog 17y agoA recent NY Times article[1] talked about just this. On auction sites like ebay, competitors can lock that accounts of those they're bidding against in order to win auctions. 1. http://www.nytimes.com/2010/01/21/technology/21password.html http://www.nytimes.com/2010/01/21/technology/21password.html