4 ms·
We discovered the optimal number of password errors
- Bostonian 5y agoIt's 5 according to the article, by Karen Renaud: "I developed a simulator called SimPass. It modeled password-related behaviors of virtual “agents” with human propensities, using well-established forgetting statistics to model predictable password choices, forgetting, reuse and sharing. Some malicious “agents” would attempt to breach accounts. I worked with my colleague Rosanne English to test different lockout settings. We ran 500 simulations for each of three, five, seven, nine, 11 and 13 tries before lockout. What we found was that five was actually the optimal number—the sweet spot we were hoping to identify. When allowing five attempts, the number of lockouts were minimized, with no adverse effect on security."