2 ms·
"If a user overrides a lockout and gets a new password, what is to stop the lockout process from starting over again as the attackers continue trying." Nothing
by randallsquared 18y ago
"If a user overrides a lockout and gets a new password, what is to stop the lockout process from starting over again as the attackers continue trying."
Nothing stops that. However, if the password has to be reset to a random string every 20 attempts before you can do the 21st attempt (say, in a day), then it hardly matters how vulnerable it was originally.
- timf 18y agoNothing ultimately stops that but I am hoping a per-IP approach to lockouts will relieve my bona fide users from needing to go through a tedious reset process (potentially often). If you backoff to 5 minutes max per IP that leaves 288 tries a day per IP (well, slightly more because of the part where it backs off). With eight character minimum passwords, someone with a botnet would have to have probably thousands and thousands of unique IPs at their disposable to even being successfully brute forcing...?
- randallsquared 18y agoThe existence of botnets does complicate matters, though, as you note. In general, I don't agree that this is a matter for site designers; the more we try to protect the users from themselves, the more it will be our liability when we ultimately fail (and we will fail in the end).