3 ms·
Why not just lock out a user after n failed login attempts?
by euroclydon 17y ago
Why not just lock out a user after n failed login attempts?
- ShabbyDoo 17y agoAs long as there's a reasonable way to unlock a user. For a free consumer site, it can't require human interaction. "Email me a new password" seems reasonable for most cases.
- sorbits 17y agoI have a common four character name as login with Apple’s developer connection. I regularly get locked out (and have to request a new password) presumably because other users try to login to my account (not remembering their real login). This scheme sucks! Perhaps a better scheme would be to ban the IP for 10 minutes after half a dozen failed logins.
- DougBTX 17y agoIt makes it easy for someone to launch a denial-of-login attack, just set a script to log in with n random passwords, then the user won't be able to log in. With a rate limit, once the attack is over or blocked, the user can log in. With a ban after n, they would have to manually reset their password after each attack, which could be set to happen eg once an hour. Not that I've ever knowingly heard of someone getting attacked in such a way.
- euroclydon 17y agoWow, but if an attacker had a bunch of your user's usernames, that would be a major way for them to damage your site.
- thechangelog 17y agoA recent NY Times article[1] talked about just this. On auction sites like ebay, competitors can lock that accounts of those they're bidding against in order to win auctions. 1. http://www.nytimes.com/2010/01/21/technology/21password.html http://www.nytimes.com/2010/01/21/technology/21password.html