4 ms·

I suppose it's a bit different from a user facing login, but does anyone know why these limits tend to be set so low? I've locked myself out of plenty of thing

by cgag 14y ago

I suppose it's a bit different from a user facing login, but does anyone know why these limits tend to be set so low? I've locked myself out of plenty of things, and so have plenty of people I know. It seems like setting the limit to 20 would be just as effective in blocking brute force attacks without being user unfriendly. Is it that with user facing services the common user/passwords are so common it's reasonable to just try just the top x most common passwords?

ramidarigaz 14y ago
So far it hasn't been a problem (fingers crossed). I have a couple ways into the server in case I get myself banned. Also, it's my personal server, so the only user that would complain is me :) For other sites, I'm honestly not sure how they go about choosing a limit. 20 does seem to be more reasonable, while still being perfectly safe.
trb 14y ago
Intuition, most of the time. Here are some quite common ones: http://www.splashdata.com/press/PR121023.htm http://www.splashdata.com/press/PR121023.htm There's no reason why you would have a three attempts limit, or five, or ten, and so on. If I get three per account, I'll just use the top three and try again different accounts. If I get three attempts per IP, I'll use many different IPs and do the same. To remain user friendly, delays are the way to go. E.g. you could have three different delays that add to each other: Account-level, IP-level and global. Increase each with every failed attempt up to 30 seconds of wait time, and add them together. This will slow down brute force attempts to the point where they're useless, while still allowing legitimate users to login (just with a little inconvenience). As a result, if I failed three attempts with one account, and three one next, etc., my IP-level limit will prohibit me from moving on to other accounts. If I try a lot of passwords on one account, the account-level and IP-level ones will slow me down. And if there's a distributed attack with many IPs, the global delay will reduce the damage the attack can do. All the while legitimate users can still use the service.

by cgag 14y ago

ramidarigaz 14y ago

So far it hasn't been a problem (fingers crossed). I have a couple ways into the server in case I get myself banned. Also, it's my personal server, so the only user that would complain is me :) For other sites, I'm honestly not sure how they go about choosing a limit. 20 does seem to be more reasonable, while still being perfectly safe.

trb 14y ago

Intuition, most of the time. Here are some quite common ones: http://www.splashdata.com/press/PR121023.htm http://www.splashdata.com/press/PR121023.htm There's no reason why you would have a three attempts limit, or five, or ten, and so on. If I get three per account, I'll just use the top three and try again different accounts. If I get three attempts per IP, I'll use many different IPs and do the same. To remain user friendly, delays are the way to go. E.g. you could have three different delays that add to each other: Account-level, IP-level and global. Increase each with every failed attempt up to 30 seconds of wait time, and add them together. This will slow down brute force attempts to the point where they're useless, while still allowing legitimate users to login (just with a little inconvenience). As a result, if I failed three attempts with one account, and three one next, etc., my IP-level limit will prohibit me from moving on to other accounts. If I try a lot of passwords on one account, the account-level and IP-level ones will slow me down. And if there's a distributed attack with many IPs, the global delay will reduce the damage the attack can do. All the while legitimate users can still use the service.