Could someone stop another from accessing their own online account?

Question

Suppose Alice isn't able to break into Bob's email account, but Alice can still do damage to Bob (a VIP) if she can stop him from being able to use his own email (or any other online) account to send and receive important emails.

So what she does is she writes a computer script that guesses a random password (since most email addresses have the same username) so that it locks her out. Could this also lock Bob out?

What if instead of one or two computers, she goes on the black market and uses thousands of bot computers around the nation to target Bob's account? Or she manages to hack Bob's wifi network so she even has the same IP address? What's there to stop Alice from making sure Bob never gets to use his own account ever again? (Besides two-factor authentication, which most people don't use.)

Answer 1

Essentially you're just talking about a very targeted Denial-of-Service. There would be plenty of ways to achieve this other than just locking out their account. If they were on the same network then there would be plenty of other ways to do it other than just locking out someones account

Answer 2

Could this also lock Bob out?

Yes.

What if instead of one or two computers, she goes on the black market and uses thousands of bot computers around the nation to target Bob's account?

Bob is going to have a bad day / week / month / year. (unless, see subsection 4)

Or she manages to hack Bob's wifi network so she even has the same IP address?

I would be more concerned about Alice being on Bob's local network and exploiting vulnerabilities on his LAN. The fact that Alice has Bob's NAT'ed IP would have little bearing unless.....

What's there to stop Alice from making sure Bob never gets to use his own account ever again?

The webmail system in question employs stronger authentication. Even then, the NAT'd IP is only a single piece of the information that is collected to determine if it truly is Bob.

Many popular webmail sites have systems/code in place to detect such attacks and will require, for example, a captcha phrase to be entered before allowing the password to post.

Sometimes instead they may require a "secret question" to be answered before posting the password.

The same protections employed to prevent brute force attacks against guessing a password also help to mitigate nefarious individuals from intentionally locking out the account.