RE: Account Lockouts

[Dean Saxe <Dean.Saxe () DigitalInsight com>]

Even if the user calls, how do I know you are the user in question and not
someone impersonating the user?  I don't have a great answer for this and
its a question that comes up regularly when dealing with locked out accounts
or resetting passwords.  


-dhs

Dean H. Saxe, CEH
Manager of Web Application Security
Digital Insight, Magnet Business Solutions
Dean.Saxe () digitalinsight com 
770-349-1514 
"In theory, theory and practice are the same. In practice, they are not."

Please be advised that the information contained in this communication may
be confidential and is intended only for the use of the individual or entity
named above. Any other use, dissemination, distribution or copying of this
communication is strictly prohibited. If you are not the intended recipient,
please notify the sender immediately and delete this message.


-----Original Message-----
From: David LeBlanc [mailto:dleblanc () exchange microsoft com] 

This depends on the asset you're trying to protect. If it is a bank, maybe I
want to force someone to call.

This would be hard to implement, but if you could also track the source IP
of the logon, you could then only allow some small number of user names to
be tried from any one IP address. Won't protect you from an army of bots,
but ought to get rid of most of the anklebiters. You may run into problems
with large proxies if you use this approach, but again, this depends on your
use scenario.

Injecting some randomization into the user names would make sense. Make the
attacker guess as much as possible.

-----Original Message-----
From: Harrison Gladden [mailto:hgladden () gmail com] 

Hello all, 

My question to the group is about handling account lock outs.  Here's the
situation, assume there is a web interface that lets users log in and do
stuff, but the log-in process is constrained by the network restrictions as
well.. Meaning if a user tries to log in X times in Y seconds and fails each
time, then the account get locked out.

What are successfull techniques that could be used on the web interface to
avoid having a script run against it that would potentially lock out 15000
user accounts, and create a headache for the system administrators who have
to manually unlock each account?

Also assume the current user account names are known by everyone.  

Possible techniques we've thrown around:
1)  Allow each user to pick their own username instead of using a standard
(i.e. First 3 letters of first name + Full last name)

2) Create a set time-out period  for each account of  X (maybe an hour)