4 ms·

Your argument does essentially shoot down any merit to 5 second login attempt delays, and a cap on the number of attempts in 15 minutes.

asharp 16y ago
Not particularly. An attack that leaves the attacker with password hashes is rare, as opposed to regular "brute force" attacks of various flavours.
- queensnake 16y ago
  (Couldn't a hacker have 500 connections and, though trying each only every 5 secs as permitted, still get 100/s overall?)
  - asharp 16y ago
    Only in the case of a very badly configured server.
jtheory 16y ago
Login delays have serious problems anyway. If you include a serious delay (like, "10 attempts to guess a user's password and we lock the account for an hour" or if you lock accounts & require admin unlocking), this is a great way to set yourself up for a quiet DoS. I don't have to bring your server to its knees -- I can lock our any user with only 10 requests, ha ha... If you save the limit in the browser session, well, it's easy to start a new session for each attempt (just don't send in any established cookie). Limiting per IP is a bit stronger, but with large NATs this is still as risk of DoSing. If you use just a small timeout -- like 5 seconds -- that means any individual attempt will take 5 seconds to return. Let's say I submit 100 requests in 100 threads. Will it take 500 seconds to return? Nope -- each thread will take 5 seconds, concurrently, and I'll have the results back in request tine + 5 seconds. Also don't forget that an attacker is not required to choose a single email address and try to brute-force passwords. In fact, it's probably more efficient to take one common password at a time and try likely usernames.
- jtheory 16y ago
  Huh -- yet another wrinkle. If you track by IP address, you may have serious problems in the UK, where many ISPs are filtering all of their users through a few proxy servers (so it will then appear as if all users routed through a given proxy server are all on the same IP...). http://grimboy.co.uk/blawg/in-the-uk-being-told-youre-already-downloading-or-have-failed-the-captcha-too-many-times-by-file-hosting-sites-for-no-reason-you-might-be-being-iwfd/ http://grimboy.co.uk/blawg/in-the-uk-being-told-youre-alread...

asharp 16y ago

Not particularly. An attack that leaves the attacker with password hashes is rare, as opposed to regular "brute force" attacks of various flavours.

queensnake 16y ago
(Couldn't a hacker have 500 connections and, though trying each only every 5 secs as permitted, still get 100/s overall?)
- asharp 16y ago
  Only in the case of a very badly configured server.

jtheory 16y ago

Login delays have serious problems anyway. If you include a serious delay (like, "10 attempts to guess a user's password and we lock the account for an hour" or if you lock accounts & require admin unlocking), this is a great way to set yourself up for a quiet DoS. I don't have to bring your server to its knees -- I can lock our any user with only 10 requests, ha ha... If you save the limit in the browser session, well, it's easy to start a new session for each attempt (just don't send in any established cookie). Limiting per IP is a bit stronger, but with large NATs this is still as risk of DoSing. If you use just a small timeout -- like 5 seconds -- that means any individual attempt will take 5 seconds to return. Let's say I submit 100 requests in 100 threads. Will it take 500 seconds to return? Nope -- each thread will take 5 seconds, concurrently, and I'll have the results back in request tine + 5 seconds. Also don't forget that an attacker is not required to choose a single email address and try to brute-force passwords. In fact, it's probably more efficient to take one common password at a time and try likely usernames.

jtheory 16y ago
Huh -- yet another wrinkle. If you track by IP address, you may have serious problems in the UK, where many ISPs are filtering all of their users through a few proxy servers (so it will then appear as if all users routed through a given proxy server are all on the same IP...). http://grimboy.co.uk/blawg/in-the-uk-being-told-youre-already-downloading-or-have-failed-the-captcha-too-many-times-by-file-hosting-sites-for-no-reason-you-might-be-being-iwfd/ http://grimboy.co.uk/blawg/in-the-uk-being-told-youre-alread...