0

I am debating the merits of a feature being requested for our web application.

The request is asking for an email to be issued to a user when an account is locked. Accounts are locked after 5 failed attempts. For each failed attempt the user is simply informed of an invalid username / password and we don't indicate the account is locked on the front end, to mitigate against username enumeration.

My points against this request are

  1. I am suggesting the feature could possibly open the email system to attack by locking all users accounts and issuing emails on mass assuming someone knows all usernames.

  2. Feature does not add value to the user, as our product provides a nice forgotten password ability.

Any thoughts, recommendations or industry standard. From my knowledge as long as a secure feature allowing user to initiate forgotten password should suffice.

Improve this question
2
  • Well, you don't indicate that the account is locked, so is a legitimate user whose account has been locked by an attacker going to know that they need to use the forgotten password function to regain access? If they use a password manager app, for example, they can be pretty sure they've not forgotten it, so are going to blame your application...
    – Matthew
    Commented Nov 22, 2016 at 11:27
  • This is a good point regarding password managers. I would naturally use forgotten password if my credentials are not working. Can you point me to other applications where they issue emails when your account is locked ?
    – Darragh
    Commented Nov 22, 2016 at 17:29

1 Answer 1

Reset to default
1

The addition of the user requested feature doesn't seem to add any security vulnerability to the current flow of things.

I am suggesting the feature could possibly open the email system to attack by locking all users accounts and issuing emails on mass assuming someone knows all usernames.

Does the "forgot username/password" feature send an email to the user with a password reset link? If so, then an attacker that knows the username could still force the victim to be peppered with a different category of emails, by initiating password reset emails a bunch of times

Feature does not add value to the user, as our product provides a nice forgotten password ability.

In line with Matthew's comment, the average user very probably does not know why they are not able to successfully log in. Unless they explicitly know that this because of a lockout, they would most likely blame the application.

Additionally, it is never bad to have a measure in place that doesn't pepper locked out users with repeated "locked-out" emails. One email with the necessary information on the account being locked out should be sufficient. The user not acting on the email is their own bad. Beyond that, as you say, they could always access the forgot password feature.

Improve this answer
2
  • thanks @katrix. In our implementation of Forgotten Password, the user is expected to enter something basic like Date of Birth in order for the email to issue, this would mean an attacker would need to know all usernames and date of births, we also allow a customer to use last four digits of Bank Account or Social Security number. The point being is not simply enter your username and the email is issued. I accept your points and the suggestion of one email also makes sense.
    – Darragh
    Commented Nov 22, 2016 at 17:25
  • Even if you only enter the username and ask for the password recovery email, the attacker will not be able to reset the password, as the user will receive an email, will have to open the link, and enter another password twice. Just consider that your password reset process must account for timing issues: if the username does not exist, the response time will be different.
    – ThoriumBR
    Commented Nov 22, 2016 at 18:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .