Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to limit login attempts.

One option is to count attempts by IP address and then block the IP. The disadvantage is that different users may have the same IP address. Another option is to limit by an account identifier (username or email) and then block the account (it can be activated manually by support). The only disadvantage I can think of is that malicious users can guess usernames and block them... But other than that, it feels more secure because malicious users can use different IPs, right?

What's the recommended way to do it?

share|improve this question
3  
Instead of permanent blocking, consider throttling (both by IP and by username): after X failed login attempts, every next failed attempt results in e.g. 5 seconds block. – user11153 Mar 1 at 13:04
    
@user11153 Why not go one step further and throttle longer for each failed attempt beyond the X. – Nightwolf Mar 1 at 15:32
3  
@Nightwolf Because in that case you again have risk of DoS attack (at least when blocking by username). – user11153 Mar 1 at 15:35
    
I use an anonymizing http proxy that gives me a new IP address every request. – Neil McGuigan Mar 1 at 19:31
    
My inclination would be to be a bit careful about IP bans--pay attention to how many legitimate logins you get from an IP. If many users log in from a single IP you should be very cautious about IP-banning it--you're really seeing something other than the user's address. – Loren Pechtel Mar 1 at 22:48
up vote 30 down vote accepted

I would say that you should do both.

If you only rate limit on IP address, an attacker controlling a bot net could brute force an account with a weak password. If you have 10 000 computers with unique IPs and each one is allowed four attempts per hour you can try almost a million passwords per day.

If you only rate limit on username, an attacker with a list of existing usernames could brute force accounts with a weak password. Chances are that a few of your users use one of the top 10 passwords, so if you try those on all accounts you will get in somewhere.

Of course you could do all sorts of combinations. For instance you might only block a username once X different IPs have failed to log in with it, so that an attacker trying to block a user from logging in needs to work a bit for it.

share|improve this answer

Threat Model

It really depends on your threat model:

  • How bad is a DOS attack against users in comparison to the compromisation of a user account?
  • Does an attacker want to attack one specific user, or just collect as many valid credentials as possible? (in the first case you would want to block by username, in the second by IP).
  • How easy is it to unblock a blocked username for a legitimate user?
  • ...

Examples

Lets take ebay as an example:

  • A DOS attack would be pretty bad. Someone could prevent all users that are competing on a bid from being able to log in.
  • Of course, account compromisation is also not a good thing, but payment is secured (I think, it should be) by requiring some further information (for example, when paying via paypal, you would need to enter your paypal password). Additionally, banning by username only adds security if an attacker wants to attack a specific user. If they just want as many accounts as possible, blocking usernames doesn't limit attackers. Only blocking IPs does.

So in this example - access to the application is somewhat critical, and an attacker does not attack specific user accounts -, limiting by IP would be the right decision, and limiting by username would be damaging.

Lets take another example: An admin login for a web application:

  • You likely don't need to worry about DOS. Yes, it would be a minor annoyance, but the admin likely has simple methods of regaining their account. Maybe the login page is also hidden, so an attacker would need to guess that first.
  • An attacker only wants to attack that one admin account and they may have quite a few proxies. Blocking that account makes sense here.

So here, blocking by IP has a low effect on the attacker, while blocking by username would be the correct choice.

share|improve this answer

You should rate limit both.

Giving an account limited login attempts (from all IPs) is pretty standard and will stop an attempt to guess a user's password.

You should also rate limit each IP address against incorrect login attempts for all attempted accounts, so they can't max out one account and try against another over and over.

Of course, this is on top of standard anti-DDoS request limiting.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.