Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am concerned about how does email services like Yahoo, Gmail, Hotmail etc provide security to their costumers and prevent their account from being compromised. For example, I have seen that if someone tries Brute Force Attack on Yahoo. After some attempts the account is blocked for some time. This gives rise to two problems,

  1. The account is anyhow going to be unblocked by the email service. So, can't the Brute Force Attack be continued? Isn't it dangerous for the security of the user?

  2. If the software attacking (say some Brute Force Attacking Program) is continuously attacking the email address, then the account is kept blocked and the user has to wait. Does the email service provide any other option if such a problem occurs?

share|improve this question

3 Answers 3

Gmail provides you with an out-of-band channel when logging from an unrecognized device! you can enable this two factors authentication feature so that every time you try to log in you have to provide an additional confirmation code that you get either from a phone call or just a text message. neither Yahoo, nor hotmail has already implemented this yet

share|improve this answer
    
Thanks for the answer. I did not knew that :) –  Fahad Uddin Aug 27 '11 at 18:00

The "block for some time" policy is a relaxation of an older policy which is "block until manual action from an authorized system administrator". That's what smartcards do, when they get too many wrong PIN codes. Permanent blocking is too harsh in a networked context, because it would allow anybody to block other people's accounts.

"Block for some time" still drastically lowers the rate of brute force attacks: if the system blocks for 10 minutes after 3 wrong passwords, the attacker will be able to try only 432 potential passwords per day -- thus, passwords of relatively low entropy can be tolerated.

If someone has a grudge against you and repeatedly blocks your account, then some other countermeasures are possible, such as blacklisting the IP of your enemy. If the bad guy uses a Distributed Denial of Service attack, with millions of zombie machines hard at work blocking your account, then you are hosed. Sorry. There is no good computer-based defense against that (classical police investigation work and SWAT teams can be efficient, though).

share|improve this answer
    
Thanks alot for the answer. I was reading DDOS attack after reading your post. Can you please explain what is authentication request that the computer requests from the user? –  Fahad Uddin Aug 27 '11 at 17:59

Often, simply just set the timer of valid logins to about 3 seconds per login try will reduce any succesful chance of brute forcing an email account or any other login service.

share|improve this answer
1  
Or the other popular one is doubling the timeout on each fail - the time rapidly gets so high that brute force is effectively impossible:-) –  Rory Alsop Sep 5 '11 at 13:45
    
Didnt think about that, but yeah.. it will rule out any chance of bruteforcing unless using a botnet, but if you do the lock out pr account, it will be next to impossible :) –  psalomonsen Sep 5 '11 at 14:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.