4 ms·
I was thinking about limiting the number of password attempts per time interval by user -- not the total number of attempts at any user's password per interval.
by ShabbyDoo 17y ago
I was thinking about limiting the number of password attempts per time interval by user -- not the total number of attempts at any user's password per interval. Does that fix the DOS concern?
In the RockYou case, a botnet could try 32M * # allowed/day given that it had a user list.
- Retric 17y agoWith a large user list, some people will have really terrible passwords. So my guess would be by trying random week passwords to random accounts you could compromise a few hundred accounts in the first day. With diminishing returns over time.
- ShabbyDoo 17y agoSo, the user list would have to be available/harvestable? I guess this is an argument for having separate login Ids and published usernames. So, one couldn't just spider a site to create a user list.
- roundsquare 17y agoEven if it doesn't solve the problem, seems like it would help. In this case, a user would need to have a "very weak" password to be compromised. "Somewhat weak" passwords would be fine. Also, after 100 or so attempts to login, I would thinking locking the user out would be fine (at least in many systems).
- Retric 17y agoThat recreates the ability to lock people out of the system once you know their user ID. Edit: However, a useful option is to force people to use a captia after a few bad atempts.