4 ms·
Stupid question here. But shouldn't websites/apps simply lock the account for 5 minutes after 3 bad password attempts? -- basically ending the usefulness of
by ransom1538 8y ago
Stupid question here. But shouldn't websites/apps simply lock the account for 5 minutes after 3 bad password attempts? -- basically ending the usefulness of bad password lists, etc etc. Do sites actually let you run limitless password attempts -- thus really find these password lists important? If your password was "foofoo", and there was a password lock after 3 attempts I don't see how you would crack it with a password file (in this lifetime).
- snowwolf 8y agoBecause the email/password combination is already known. From a previous breach where you used the same combination. So the attacker needs exactly 1 attempt to get into your account. And with the ease of using botnets now, they can get access to a very large number of IPs to distribute the attack, so you can't reliably throttle at IP level either.
- elorant 8y agoI've tried that once in a site and it was a maintenance nightmare. Users kept bombarding me with emails asking to unlock their accounts. Turns out 99 times out of 100 that a username/password combo has been mistyped it's from users jerking around or not remembering the password, rather from hackers trying to brute force their entrance. Now imagine having a site with a few million accounts and 0,1% of them mistyping the password every now and then.
- ransom1538 8y agoYou don't have a 'forgot password' system?
- paulpauper 8y agoOne could set the threshold to 40 failed attempts. brute forcing requires thousands of attempts.
- scient 8y agoSounds like a case of not handling the UX of the feature properly. What you can do is either allow them to unlock the account via email, or have a time-based unlock, or both. We do 72 hours or unlock it via email.
- snailmailman 8y agoI think it’s more common to crack the passwords offline from a breach. Enough people reuse passwords that you can then directly try a persons password on multiple sites, without the need to guess. I think I’ve had this happen to a few old accounts of mine that reused a simple password that had been leaked. (Of course I can’t really verify how the hackers did it, but it seems likely to me)
- awat 8y agoSeems like there are some legitmate reasonings in this thread. I also wonder how much of it is just not wanting to explain making it potentially more difficult for a user to log in. Sort of like how credit card providers could make things much more secure but choose not to because of fear of reducing transactions.
- jedberg 8y agoA lot of sites don't want to lock you out because that is a denial of service vector. If someone wanted to mess with your site, especially if your usernames are public (like reddit, eBay, HN, etc), then all they have to do is keeping sending login requests with bogus passwords to lock out all of your users.
- deleted 8y ago[deleted]
- URSpider94 8y agoAs someone explained in a different comment above, modern exploit scripts will just rotate around through the entire database, trying different userid’s in series to avoid hitting rate limits per userid. Most criminals don’t actually care WHOSE account they hack, as long as they can get some monetary or data value out of any hacked account. And, if you do a hard lock-out, that’s an easy way for an attacker to DoS your entire user base in short order.