4 ms·

The goal of the attack may be to lockout the accounts, not guess the passwords. That's often overlooked.

by 16s 14y ago

newman314 14y ago
Well, there are 2 probable states: 1) Username is not known. No reason the attacker would know this short of a leak / social profile with identical username. In this case, submitting random usernames and getting a hit should trigger a lockout and corresponding alert. 2) Username is known through system compromise. In this case, the account should be locked out and a new password generated just in case. So I don't really see causing a deliberate account lockout as a primary attack vector other than trying to exploit weaknesses in password reset processes across multiple sites (like what happened to Dan Harmon). Therefore, I would say that having a lockout mechanism is better than not having one.
- semanticist 14y ago
  I don't need to compromise HackerNews to see your username. Many sites fall into that same category - anything with a social element, comments, profile pages.
- adrianhoward 14y ago
  So I don't really see causing a deliberate account lockout as a primary attack vector other than trying to exploit weaknesses in password reset processes across multiple sites (like what happened to Dan Harmon). You're assuming that the lockout is aimed at an individual. In my experience it's aimed at the site. They're trying to lock out N% of users. In which case going for common names, email addresses, etc. will get you a surprisingly large chunk of the user base. And that's ignoring the many sites where usernames are public, or easily accessible by a "normal" user that can be used to scrape them for the DOS/password bot. Therefore, I would say that having a lockout mechanism is better than not having one. Since I've seen DOS attacks that use them - I'd tend to disagree :-) Unless you're in an environment that makes them effective. For example my bank uses a lockout - but it has a private customer number that's not visible to others, along with a separate password and a 8 digit PIN (of which it only asks for three random digits). It's only when two of the three bits of information are correct that the lockout count starts - making bulk lockouts for the site pretty much impossible. So there it's an effective tool to prevent password cracking.

The goal of the attack may be to lockout the accounts, not guess the passwords. That's often overlooked.

by 16s 14y ago

The goal of the attack may be to lockout the accounts, not guess the passwords. That's often overlooked.

Well, there are 2 probable states: 1) Username is not known. No reason the attacker would know this short of a leak / social profile with identical username. In this case, submitting random usernames and getting a hit should trigger a lockout and corresponding alert. 2) Username is known through system compromise. In this case, the account should be locked out and a new password generated just in case. So I don't really see causing a deliberate account lockout as a primary attack vector other than trying to exploit weaknesses in password reset processes across multiple sites (like what happened to Dan Harmon). Therefore, I would say that having a lockout mechanism is better than not having one.

semanticist 14y ago
I don't need to compromise HackerNews to see your username. Many sites fall into that same category - anything with a social element, comments, profile pages.
adrianhoward 14y ago
So I don't really see causing a deliberate account lockout as a primary attack vector other than trying to exploit weaknesses in password reset processes across multiple sites (like what happened to Dan Harmon). You're assuming that the lockout is aimed at an individual. In my experience it's aimed at the site. They're trying to lock out N% of users. In which case going for common names, email addresses, etc. will get you a surprisingly large chunk of the user base. And that's ignoring the many sites where usernames are public, or easily accessible by a "normal" user that can be used to scrape them for the DOS/password bot. Therefore, I would say that having a lockout mechanism is better than not having one. Since I've seen DOS attacks that use them - I'd tend to disagree :-) Unless you're in an environment that makes them effective. For example my bank uses a lockout - but it has a private customer number that's not visible to others, along with a separate password and a 8 digit PIN (of which it only asks for three random digits). It's only when two of the three bits of information are correct that the lockout count starts - making bulk lockouts for the site pretty much impossible. So there it's an effective tool to prevent password cracking.