1

Prologue. Imagine a website with a login. You have an account, enter your e-mail address and a password. Error. Password incorrect. You try two other passwords. Both incorrect and now your account is locked. Fortunately, it's not a timed lock, but you do have to change your password. I click the link in the "you forgot your password"-e-mail and enter a new password. The website responds with: "please choose a password other than your current password".

OK, so here's my question: would there be (other) security risks involved if, instead of forcing me to change my password, the e-mail they send me after n invalid passwords, would contain a link that sends me back to the login page, but with n new login attempts?

Improve this question
3
  • This doesn't seem very convenient from a user's perspective: You type in the wrong password three times, head to your email inbox, click a link just to try another 20 passwords? Seems somewhat strage to me (though not insecure).
    – Lukas
    Mar 15, 2017 at 16:31
  • 2
    Not really any risks, assuming you'd send them a password reset link that way anyway. Could be a nice option to the user to keep trying rather than resetting.
    – Arlix
    Mar 15, 2017 at 16:32
  • @Lukas: For convenience, we could also provide a link to let the user log in right away (without providing a password). The goal here is to not force the user to change his password when his/her memory is failing them (momentarily).
    – Protector one
    Mar 17, 2017 at 9:42

2 Answers 2

Reset to default
1

Your user interface should give no indication that the user is locked out. See the OWASP guidance on this matter.

When you consider this little detail, the idea of providing a link for "three more" attempts doesn't make any sense.

Also, I don't see any harm in letting the user reset his password to his existing password, if by some weird quirk he remembers it when resetting. However, if he chooses to keep it, you should retain the old "password create date" value (if you are enforcing password expiration).

Improve this answer
9
  • 1
    Wow. What?? So you mean that the recommended way is to not let the user know if he has wasted all his attempts?? So, if I only had 3 attempts, and I guessed my password on the 4th try, it wouldn't even tell me?? That can't be right. That would be very evil.
    – Protector one
    Mar 15, 2017 at 18:28
  • 1
    The problem with showing a specific message is that it allows hackers to try farm user IDs. If this isn't a worry for you, you can ignore the guidance, as long as you are aware of it.
    – John Wu
    Mar 15, 2017 at 18:38
  • 1
    You're right, but a bit later under "prevent Brute Force Attacks", they also suggest you lock accounts for 20 minutes after too many guesses. To not give ANY hint about not being able to log in for the next 20 minutes to a legitimate user is idiotic, just as @Protector one said. Leaking information about the locked state is not a problem, since an attacker can actually force that state himself by simply entering too many wrong password guesses. The important thing is, just as you say, not leaking information about account existence.
    – Out of Band
    Mar 15, 2017 at 20:01
  • 2
    Here's how we did it, for what it's worth. We keep a counter that is session-based (not user based) and increment it each time a signon is attempted, even if the user ID doesn't exist. After three tries we display an error "Having trouble signing in? [get help]" The help link lets them reset their password or get an email reminding them of their user ID.
    – John Wu
    Mar 15, 2017 at 20:04
  • 1
    @JohnWu: Sounds very good from a user's perspective, but I'm wondering: How do you prevent brute forcing? If the counter is session based, what happens if an attacker doesn't send back his session cookie (assuming you're using cookies)? Does he get unlimited tries, or do you block him with some other method?
    – Out of Band
    Mar 15, 2017 at 20:15
1

A lot of websites use the reCaptcha when someone is starting to have failed login attempts. The reason this is good is because 1) it's anti-bot because bots have a hard time reading images and 2)It keeps your user on the page without having to leave or cause any extra hassle such as having to log into their email for a new link.

There wouldn't be that much security risk but in the worse case scenario, if an attacker also had access to your email account, he can write a bot to login into your email, get the link, navigate to the link and start trying again and repeat the process. I think the best solution is to implement reCaptcha after a user gets too many incorrect passwords.

Improve this answer
5
  • Isn't reCaptcher now a little "broken" with the use of voice recognition? Saw it a lot in last time. Like here: bleepingcomputer.com/news/security/…
    – Serverfrog
    Mar 15, 2017 at 16:45
  • @Serverfrog good point to bring up, I know google is currently working on reCaptcha version 3 which will solve the issue because i believe it won't have the audio option such as version 2. I think this attack is pretty complicated and will deter any script kiddies. But it is a valid point to bring up and hopefully Google will fix this. But there are other "reCaptcha" libraries to use out there that don't include the audio/microphone option
    – nd510
    Mar 15, 2017 at 16:52
  • Wait, what? If an attacker had my e-mail and password? You mean if he has access to my e-mail account??
    – Protector one
    Mar 15, 2017 at 18:25
  • 1
    @Protectorone yes sorry, if he had access to your email account
    – nd510
    Mar 15, 2017 at 18:27
  • I see your point now. Good! But I'm not sure if this is enough of an issue to advise against it. I mean, if an attacker has control of my e-mail account, I'm already in trouble.
    – Protector one
    Mar 15, 2017 at 18:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .