5 ms·

I simply don't understand how brute-forcing can remain a problem today. It seems like such a trivial implementation detail to freeze account access after a cert

I simply don't understand how brute-forcing can remain a problem today. It seems like such a trivial implementation detail to freeze account access after a certain number of incorrect attempts – and yet most password security guidelines still warn against what they consider brute-forceable passwords. Could a security professional explain in non-domain-expert terms why this practice isn't simply adopted everywhere?

cecilpl 14y ago
Because the people who implement the login systems aren't always security professionals. Sometimes they're random, mediocre, software engineers who don't really care about security, but their boss put them in charge of the website.
- peterwwillis 14y ago
  And the boss isn't a security professional (or even a software engineer, half the time) so he doesn't care. In fact, there's commonly an entire culture all the way up the ladder where nobody gives a shit about security, so terrible holes stay wide open for years.
  - dasil003 14y ago
    This is where the Anonymouses of the world are doing a real service for the world. People need to forced by real consequences to take security seriously. There's not anything wrong with that either. As humans, we have limited available attention. You and I might argue that security is critical, but even thinking about everything that is reasonably deemed critical is paralyzing. Statistically organizations are just not going to take security seriously on the whole until they get pwned to the tune of billions.
    - peterwwillis 14y ago
      I can't think of an example i've seen where Anonymous-like breaches caused anyone but the actually breached companies to reflect on their security (Sony didn't even react immediately, they got pwnd three times). Releasing personal information just isn't a threat to companies in the era of Facebook.
      - dasil003 14y ago
        How would such an example be visible to you?
- misiti3780 14y ago
  Does it really matter that they are/are not security professionals? Virgin Mobile is a major corporation, and (if I understand the vulnerability correctly) are willing to let a unique IP ping their server 1MM times in a day. Rate limiting software is open-source and easy to come by. How does Virgin mobile prevent DDOS attacks if this vulnerability exists?
  - peterwwillis 14y ago
    Just because they're a major corporation doesn't mean anyone with any clout gives a shit about whether or not customer logins are being brute forced, or if their servers can be DDOS'd. Even if somebody cared to mention it, somebody else would mention that it's too expensive, they're not getting attacked right now, and there's more important problems to worry about, so it gets ignored. This is not just cynicism on my part - this is how most companies operate. When they start losing money they'll start caring about security. Oh, and DDOS has nothing to do with rate limiting. If you fill up a pipe with incoming packets it's going to become unresponsive. There's no real way to stop it, but multi-homing, global distribution and some tricks administered by DDOS mitigation companies can help.
colonelxc 14y ago
I think that one of the reasons it is not implemented is because it is a problem that isn't purely technical in nature. So you want to lock people's accounts to prevent brute forcing? There are still a bunch of decisions (both business and technical) before you can move forward. 1. User support. How willing are you to deal with increased need for customer support when they start locking themselves out of their accounts after a dozen failed attempts? 2. How do you keep track of the number of failed attempts? Another column in your database? I don't run any big websites, but it seems to me that if an attacker can cause a write to your DB for every POST he can throw at you, your website performance will suffer. 3. If it takes a dozen (or a hundred (or a thousand)) failed logins to lock an account, it would be trivial for an attacker to lock users out of their accounts, DOSing your site in a different way. 4. Ok, so we block IP addresses instead of accounts? Now we have to deal with issues of shared or easily changed IP addresses (or botnets that can afford to have hundreds of thousands of IPs blacklisted from a site and still keep brute forcing). A lot of these issues are surmountable, but not until you do some basic threat modeling to decide what you want to protect against. Maybe you decide to focus on preventing from attackers coming from one IP from slamming your site, so you keep an in-memory table of number of recent failed logins and perform temporary bans. It wont protect against botnets, but hopefully you are paying attention to what is happening on your site, and can make changes if that becomes an issue. > yet most password security guidelines still warn against what they consider brute-forceable passwords. Your password should be hard to brute force, regardless of whether or not the site protects itself from brute forced logins. The other big danger is that someone hacks the site and gets a dump of password hashes. Then, it doesn't matter what anti-brute force techniques the website is using if the attacker can perform an offline brute force attack against your hashes.
- deleted 14y ago
  [deleted]
- robmil 14y ago
  Instead of freezing the account until it's unlocked by customer service, why not just lock it for increasingly longer periods of time? 2 seconds after the third failed attempt, 3 after the fourth, 5 after the sixth, 10 after the seventh, etc. Not too inconvenient for legitimate users trying to remember their passwords, but it surely makes bruteforcing impossible (if by the 1,000th attempt they're having to wait an hour between attempts).
perlgeek 14y ago
Automatically freezing an account makes it easy for an attacker to denial-of-service an account. Just try to login as many times as it takes to freeze the account, and then it's not available anymore to the legitimate user.
PeterisP 14y ago
Pick a random PIN - say, 197326 - and try it against a lot of account (phone) numbers. Skirt IP-restrictions by renting a botnet for 15 minutes.
- davotoula 14y ago
  WTH, that's my pwd! :-)
s_henry_paulson 14y ago
Simple answer: The greater the restrictions on the account lockout policy, the more personnel you need to hire (salary, health benefits, pension, 401k) to deal with people who manage to lock their accounts out.
- jiggy2011 14y ago
  Or just outsource it to the lowest bidder, or better yet an automated system.
- talmand 14y ago
  But how much does it cost them when these problems arise?

cecilpl 14y ago

Because the people who implement the login systems aren't always security professionals. Sometimes they're random, mediocre, software engineers who don't really care about security, but their boss put them in charge of the website.

peterwwillis 14y ago
And the boss isn't a security professional (or even a software engineer, half the time) so he doesn't care. In fact, there's commonly an entire culture all the way up the ladder where nobody gives a shit about security, so terrible holes stay wide open for years.
- dasil003 14y ago
  This is where the Anonymouses of the world are doing a real service for the world. People need to forced by real consequences to take security seriously. There's not anything wrong with that either. As humans, we have limited available attention. You and I might argue that security is critical, but even thinking about everything that is reasonably deemed critical is paralyzing. Statistically organizations are just not going to take security seriously on the whole until they get pwned to the tune of billions.
  - peterwwillis 14y ago
    I can't think of an example i've seen where Anonymous-like breaches caused anyone but the actually breached companies to reflect on their security (Sony didn't even react immediately, they got pwnd three times). Releasing personal information just isn't a threat to companies in the era of Facebook.
    - dasil003 14y ago
      How would such an example be visible to you?
misiti3780 14y ago
Does it really matter that they are/are not security professionals? Virgin Mobile is a major corporation, and (if I understand the vulnerability correctly) are willing to let a unique IP ping their server 1MM times in a day. Rate limiting software is open-source and easy to come by. How does Virgin mobile prevent DDOS attacks if this vulnerability exists?
- peterwwillis 14y ago
  Just because they're a major corporation doesn't mean anyone with any clout gives a shit about whether or not customer logins are being brute forced, or if their servers can be DDOS'd. Even if somebody cared to mention it, somebody else would mention that it's too expensive, they're not getting attacked right now, and there's more important problems to worry about, so it gets ignored. This is not just cynicism on my part - this is how most companies operate. When they start losing money they'll start caring about security. Oh, and DDOS has nothing to do with rate limiting. If you fill up a pipe with incoming packets it's going to become unresponsive. There's no real way to stop it, but multi-homing, global distribution and some tricks administered by DDOS mitigation companies can help.

colonelxc 14y ago

I think that one of the reasons it is not implemented is because it is a problem that isn't purely technical in nature. So you want to lock people's accounts to prevent brute forcing? There are still a bunch of decisions (both business and technical) before you can move forward. 1. User support. How willing are you to deal with increased need for customer support when they start locking themselves out of their accounts after a dozen failed attempts? 2. How do you keep track of the number of failed attempts? Another column in your database? I don't run any big websites, but it seems to me that if an attacker can cause a write to your DB for every POST he can throw at you, your website performance will suffer. 3. If it takes a dozen (or a hundred (or a thousand)) failed logins to lock an account, it would be trivial for an attacker to lock users out of their accounts, DOSing your site in a different way. 4. Ok, so we block IP addresses instead of accounts? Now we have to deal with issues of shared or easily changed IP addresses (or botnets that can afford to have hundreds of thousands of IPs blacklisted from a site and still keep brute forcing). A lot of these issues are surmountable, but not until you do some basic threat modeling to decide what you want to protect against. Maybe you decide to focus on preventing from attackers coming from one IP from slamming your site, so you keep an in-memory table of number of recent failed logins and perform temporary bans. It wont protect against botnets, but hopefully you are paying attention to what is happening on your site, and can make changes if that becomes an issue. > yet most password security guidelines still warn against what they consider brute-forceable passwords. Your password should be hard to brute force, regardless of whether or not the site protects itself from brute forced logins. The other big danger is that someone hacks the site and gets a dump of password hashes. Then, it doesn't matter what anti-brute force techniques the website is using if the attacker can perform an offline brute force attack against your hashes.

deleted 14y ago
[deleted]
robmil 14y ago
Instead of freezing the account until it's unlocked by customer service, why not just lock it for increasingly longer periods of time? 2 seconds after the third failed attempt, 3 after the fourth, 5 after the sixth, 10 after the seventh, etc. Not too inconvenient for legitimate users trying to remember their passwords, but it surely makes bruteforcing impossible (if by the 1,000th attempt they're having to wait an hour between attempts).

perlgeek 14y ago

Automatically freezing an account makes it easy for an attacker to denial-of-service an account. Just try to login as many times as it takes to freeze the account, and then it's not available anymore to the legitimate user.

PeterisP 14y ago

Pick a random PIN - say, 197326 - and try it against a lot of account (phone) numbers. Skirt IP-restrictions by renting a botnet for 15 minutes.

davotoula 14y ago
WTH, that's my pwd! :-)

s_henry_paulson 14y ago

Simple answer: The greater the restrictions on the account lockout policy, the more personnel you need to hire (salary, health benefits, pension, 401k) to deal with people who manage to lock their accounts out.

jiggy2011 14y ago
Or just outsource it to the lowest bidder, or better yet an automated system.
talmand 14y ago
But how much does it cost them when these problems arise?