Strong password vs. restriction on number of attempts

Question

To begin with, I am considering the password protection of standard internet services like Gmail or Dropbox. They often force users to choose a "strong" password, that is many characters, including uppercase letters and digits, so probably Password1 would work.

But bank cards usually have 4-digits passwords, whose security is based on the restriction on the number of attempts, usually limited to 10. After that many tries, you must visit your bank to unlock your card.

Why do internet services not go the same way? For example, after 10 incorrect passwords your account would be blocked for a day, after ten more -- for a week, and so on. If you are its owner, than you probably would not enter incorrect password 10 times. The problem I imagine lies in the fact that somebody else may be able to block your account. But probably the IP-address check will do.

Is this lockout technique not better than forcing a user to choose a password which either only seems to be strong, or is very difficult to remember and probably is written on the back of the computer? Or at least to allow a user to choose a protection method themself?

Answer 1

Credit card information is not meant to be public. If someone is brute forcing a credit card, there is a really good chance, that either it was stolen or its details were somehow compromised. That is why blocking a credit card makes sense.

Gmail ID on the other hand is meant for public use. It can be displayed in some online profile or web site, it can be printed on business card, etc. Basically you are meant to give people your ID, so they can use it to contact you. That is why blocking you off your GMail account whenever someone decides to login using your public ID (you know, just for the fun of it) is a really bad idea. The entire service could be shut down by someone with a lot of free time, determination and long enough list of e-mail addresses. :)

Answer 2

Why do internet services not go the same way?

Fundamentally, because users don't want it.

Implementing stronger security measures would mean spending money to do it, and for most internet services, stronger measures would also negatively impact the user base and usage of the service. Especially if you're an ad-revenue driven internet service (as most are), the last thing you want to do is prevent people from using your service for a period of time, because that's lost revenue.

Balancing security and convenience is difficult at the best of times, and when it comes to internet-based services, it is exceptionally difficult, because typical users, and the vast majority of users, are simply not willing to sacrifice any convenience at all, no matter how much security they get in exchange. As you note, typical password complexity schemes allow for passwords like Password1. Typical users pick a single, simple password like that, and use it for everything. (As every big password dump, ever, verifies.) They don't like to be told they can't use their password because it's laughably weak.

They just want to use the service, and are not willing to suffer much inconvenience to do so. With very few exceptions, if your service doesn't let them, there are a lot of nearly identical competing services that will, and that's where they'll go instead. And if they're not willing to "put up with" using anything remotely resembling a decent password, they certainly aren't going tolerate being locked out of their service or having an actual strong password/phrase forced on them.

To that point, here is a decent estimation and analysis of usage for Gmail's two-factor authentication option, which links a research paper from EuroSec 2015 (pdf) reaching very similar estimates. A free, optional, very secure (and easy, convenient) way to protect your Gmail account from being hijacked... and about 6.5% of people can be bothered to use it.

So, if Google can only manage to get about 6.5% of people to use a free, convenient layer of security for their online service, no one stands a chance of imposing stronger security measures on their users.

Answer 3

The simple answer is that both should be best practice. Complex passwords reduce the changes that the password can be guessed, and attempt restriction reduces (note: but does not eliminate) the chance that a malicious user will be able to brute force the credentials.

The counter-argument here is that both measures have impacts on convenience and usability. Given the number of passwords we have for services these days, limiting the number of attempts greatly increases the false-positive chance (the likelihood that a user will be blocked when they are who the say they are, but have simply forgotten their password).

Increasing password complexity makes it more difficult to remember a password, and increases the attack surface from other routes (passwords written down/saved in browser, etc.).

For bank cards, they have elected to go with the relatively simple passcodes, relying on a fairly strict (three tries and you're blocked) attempt restriction. Combined with the fact that most card terminals are either manned, or at least monitored, the added security of a complex passcode would not be worth the increased time to enter, or chance of forgetting. Speed is king, in this scenario.

Conversely, for a website, the users are anonymous, so there's not that check. Complex passwords help to combat that scenario, but badly implemented attempt restriction could cause genuine users to be blocked either through forgetfulness, or maliciousness.

Do please note, that this is not, as suggested by your title, an either/or scenario. There is nothing to prevent both methods being used, other than he convenience trade-off, or laziness on the part of the designer.

Answer 4

The problem I imagine lies in the fact that somebody else may be able to block your account. But probably the IP-address check will do.

Yes, another user could cause a Denial of Service on you by getting your password wrong on purpose. I'm not sure how you can factor IP address in here - if they guessed from another IP address that that of which you usually use, does that mean they get unlimited goes? If not, how would it differentiate between an attacker and the real user logging in from a different IP (say their router has rebooted and their ISP had allocated them a new IP)?

The difference between bank cards and a password is that bank cards are two factor. You need something you have - the card, and something you know - the PIN. Arguably you could implement your scheme if two factor authentication is used, because then for each password guess they would need to supply their second factor (e.g. Yubikey, SMS code or Google Authenticator code), and the system only counts it against their total if this is supplied correctly.

Also, a lockout for a day or a week could be quite inconvenient if the password was genuinely mistyped.

The other thing password strength indicators help protect against is when password hashes are retrieved from a system by an attacker, and the attacker attempts to crack them offline. Here, no rate limiting is possible other than key stretching by iterating the password hash in a proven way to slow any attack.

This is of particular importance because despite the warnings to the contrary, users will reuse passwords on different systems, so the one they choose for Gmail may well match the one they choose for a less secure site that gets its password list popped via SQL injection. Ensuring the password is strong in the first place helps protect its users elsewhere.

Answer 5

Nikita and Hopeless covered most of it. I'd just like to add that some websites "kinda" use the restriction method. If you remember the fappening the problem there was "easy" to guess passwords and that there was -no- limit to how many tries you had on a password, and thus brute-force worked. Apple fixed that mistake by restricting the amount of times a wrong password can be entered from one IP. I'm not sure how many VPN's they are tracking to get to the original IP but they set up a cooldown if you've entered the password wrong too many times. A lot of other websites do this aswell, meaning if you try a wrong password 10 times, you get a 30 minute cooldown from attempting to log in again, only on the IP adress those attemps occured. If this keeps happening the cooldown gets longer.

As Nikita said the problem with the cancelation/lockdown that's used on Credit Cards is that it can cause a lot of havoc, since you can "easily" get the mail adress of even Bill Gates.

Answer 6

Customer Service Costs

These answers are great, and I'd like to add that they may not be implementing that for free services due to the cost of customer service to manage locked accounts. It's much simpler for these companies to implement short time delays or captcha to slow automated attacks so they don't need to deal with angry customers who have locked themselves out after 10 attempts and likely won't be fast enough to trigger any delay meant for automated attacks.

Answer 7

Why do internet services not go the same way? For example, after 10 incorrect passwords your account would be blocked for a day, after ten more

You have your answer right there. Internet services do not block accounts after a few incorrect passwords because that would lock out the legitimate user. The attacker tries 10 common passwords and gets locked out. Now the legitimate user wants to connect, gets their password right on the first try… but can't log in.

But probably the IP-address check will do.

No, IP address checks aren't particularly helpful, because it's very easy for attackers to have control over many IP addresses. Rent time on Amazon instances, use Tor and other proxy services, use botnets of infected machines… If you limit to 10 attempts globally, the legitimate user will be blocked. If you limit to 10 attempts per IP address, then the attacker can make thousands of attempts just by surfing from IP address to IP address. Even in that case the legitimate user may be blocked — in countries that came late to the Internet, or with certain ISPs, all traffic is NATted through a few machines and thousands of users or more may end up behind the same IP address.

The lockout system on credit cards works because the card is normally in the possession of the legitimate user. If the attacker is in a position to attempt to guess the PIN, that usually means they've stolen the card, and the legitimate user will have to visit their bank to get a replacement card anyway. This fails with Internet services where it's difficult for the legitimate user to regain access to their account.

Two-factor authentication can be a great help there. To ease the burden on authentication, systems that offer two-factor authentication often accept a single factor if certain heuristics are met. Accepting just the password if the attempt comes from a known IP address, but requiring the second factor if there have been many invalid password attempts recently, is a good design.