For context, my web app will be used by users who don't have a strong technical background. What are the pros or cons for displaying a message like this?
Something like:
4
-
No point in showing them. If you want to set up a block threshold just block them, don't let the attacker know. If you let the attacker know then they wont exceed the limit, in order to avoid tipping off an admin.– john doeAug 13, 2020 at 2:51
-
So what exactly happens after the attempt limit is reached?– user10216038Aug 14, 2020 at 3:29
-
5@johndoe the attacker will know what the threshold is as soon as it is reached. Then adjust. "hiding" this information does nothing to stop an attacker.– schroeder ♦May 10, 2021 at 7:36
-
1It may also help attackers figure out if the lockout is per-user, per-IP, if it decrements after some time of inactivity, etc. So displaying the actual number of attempts remaining may be considered "information about the internal state of the server". However I think displaying a vague message about the policy is fine, ie "Accounts lock after 3 attempts".– Mike OunsworthMay 10, 2021 at 14:40
Add a comment
|
3 Answers
Possible pros:
- The user will understand they need to enter the password more carefully, to avoid getting blocked. It's like a warning. However 3 attempts is usually a very low limit, and if you raised it to 10 you wouldn't need to warn the user (because 10 wrong attempts won't be likely).
Possible cons:
- An attacker might learn your limit before trying to trigger it, so they might avoid detection in this case, although it all depends on how your security controls are set up. However if your system is connected to the internet and is subject to opportunistic attacks (by bots), the limit will be triggered all the time anyway, so any useful detection based on a hidden limit might become infeasible.
- The user will see a "scary" or annoying message, which might not be ideal for user experience.
In conclusion, from a security point of view it doesn't matter whether you show that message or not. From a UX (user experience) point of view though, it might be a better idea to hide it, and maybe raise the limit to 5 or more (depending on your needs, statistics about locked users, etc.).
-
3I disagree with the suggestion to hide it. If the user knows that they could lock themselves out, they might not be so cavalier with making stabs in the dark. It would reduce the calls in to unlock the account. Note that there is no "forgot password" feature in the screenshot.– schroeder ♦May 10, 2021 at 14:38
-
@schroeder, that's why I suggested increasing the limit a bit (maybe to 5 or more) to reduce the probability of false positives without affecting security in practice, and also noted that it depends on the OP's needs (statistics about actual false positives, options to reset password, resources dedicated to support, etc.).– reedMay 11, 2021 at 9:49
-
2Still. If I didn't know I would lock myself out, I might try 10 or more passwords. Since it doesn't hinder the attacker, a note is kind to legitimate users (and the service)– schroeder ♦May 11, 2021 at 10:14
This looks like my bank. If I mistype the password, they warn me that my card will be blocked if I don't get it correct in the next 2 trials. And that increases my stress. I don't like that message.
I would not add that kind of message because it does not helps the user remember its password. If the user mistyped the password, they will hopefully get it correct on the next try, and if they forgot it they will get it wrong again on the next try.
For an attacker, it won't change much. Assuming they can create a user on your site, they can test themselves how many passwords they can try until they get blocked.
answered May 10, 2021 at 9:44
-
2I disagree with the suggestion to hide it. If the user knows that they could lock themselves out, they might not be so cavalier with making stabs in the dark. It would reduce the calls in to unlock the account. Note that there is no "forgot password" feature in the screenshot.– schroeder ♦May 10, 2021 at 14:38
-
1But do you know what really increases your stress? Typing your password wrong 3 times and then being told: "Sorry dude! Your money is now being held hostage. Call us during business hours and if we're feeling nice we'll give it back." which is effectively what the unexpected block message is. Oct 7, 2021 at 16:51
-
"Call us..."? My bank requires me to be there in person, with my ID and bank card, and wait in the line for an hour... Oct 7, 2021 at 18:11
Most large web applications lock accounts based off of a variety of metadata, not just number of recent failed login attempts. This is because the login procedure is really about minimizing false positives (users logging as others) and false negatives (users not being able to get into their account). This can include historical login data, attacker IP and location, user agents, and even user behavior.
You might not need to spend that amount of time building an auth portal, but you are effectively building a policy that manages the same goal. In order to find out how to make the tradeoff between those two things, you have to consider:
What would be the cost of a user account compromise? What would be the cost of a user getting locked out of their account?
Then think about your lockout policy and try to determine whether any given property is making the proper tradeoff. In your case, you'll have to think about how many of your users will trigger the block with vs. without the message, and how many attackers will do the same. Personally, I doubt that with a simple trigger like "number of recent attempts" you are really going to stop any targeted attacker from learning when the threshold is. The first thing I would do if I was starting to try massive amounts of logins on a website would be to attempt it on an account I own and see if anything happened.
-
This is an answer about the merits of blocking accounts based on attempts. This is not an answer to the question asked.– schroeder ♦May 10, 2021 at 7:36