1

Prologue. Imagine a website with a login. You have an account, enter your e-mail address and a password. Error. Password incorrect. You try two other passwords. Both incorrect and now your account is locked. Fortunately, it's not a timed lock, but you do have to change your password. I click the link in the "you forgot your password"-e-mail and enter a new password. The website responds with: "please choose a password other than your current password".

OK, so here's my question: would there be (other) security risks involved if, instead of forcing me to change my password, the e-mail they send me after n invalid passwords, would contain a link that sends me back to the login page, but with n new login attempts?

  • This doesn't seem very convenient from a user's perspective: You type in the wrong password three times, head to your email inbox, click a link just to try another 20 passwords? Seems somewhat strage to me (though not insecure). – Lukas Mar 15 '17 at 16:31
  • 2
    Not really any risks, assuming you'd send them a password reset link that way anyway. Could be a nice option to the user to keep trying rather than resetting. – Arlix Mar 15 '17 at 16:32
  • @Lukas: For convenience, we could also provide a link to let the user log in right away (without providing a password). The goal here is to not force the user to change his password when his/her memory is failing them (momentarily). – Protector one Mar 17 '17 at 9:42
1

Your user interface should give no indication that the user is locked out. See the OWASP guidance on this matter.

When you consider this little detail, the idea of providing a link for "three more" attempts doesn't make any sense.

Also, I don't see any harm in letting the user reset his password to his existing password, if by some weird quirk he remembers it when resetting. However, if he chooses to keep it, you should retain the old "password create date" value (if you are enforcing password expiration).

  • 1
    Wow. What?? So you mean that the recommended way is to not let the user know if he has wasted all his attempts?? So, if I only had 3 attempts, and I guessed my password on the 4th try, it wouldn't even tell me?? That can't be right. That would be very evil. – Protector one Mar 15 '17 at 18:28
  • 1
    The problem with showing a specific message is that it allows hackers to try farm user IDs. If this isn't a worry for you, you can ignore the guidance, as long as you are aware of it. – John Wu Mar 15 '17 at 18:38
  • 1
    You're right, but a bit later under "prevent Brute Force Attacks", they also suggest you lock accounts for 20 minutes after too many guesses. To not give ANY hint about not being able to log in for the next 20 minutes to a legitimate user is idiotic, just as @Protector one said. Leaking information about the locked state is not a problem, since an attacker can actually force that state himself by simply entering too many wrong password guesses. The important thing is, just as you say, not leaking information about account existence. – Out of Band Mar 15 '17 at 20:01
  • 2
    Here's how we did it, for what it's worth. We keep a counter that is session-based (not user based) and increment it each time a signon is attempted, even if the user ID doesn't exist. After three tries we display an error "Having trouble signing in? [get help]" The help link lets them reset their password or get an email reminding them of their user ID. – John Wu Mar 15 '17 at 20:04
  • 1
    @JohnWu: Sounds very good from a user's perspective, but I'm wondering: How do you prevent brute forcing? If the counter is session based, what happens if an attacker doesn't send back his session cookie (assuming you're using cookies)? Does he get unlimited tries, or do you block him with some other method? – Out of Band Mar 15 '17 at 20:15
1

A lot of websites use the reCaptcha when someone is starting to have failed login attempts. The reason this is good is because 1) it's anti-bot because bots have a hard time reading images and 2)It keeps your user on the page without having to leave or cause any extra hassle such as having to log into their email for a new link.

There wouldn't be that much security risk but in the worse case scenario, if an attacker also had access to your email account, he can write a bot to login into your email, get the link, navigate to the link and start trying again and repeat the process. I think the best solution is to implement reCaptcha after a user gets too many incorrect passwords.

  • Isn't reCaptcher now a little "broken" with the use of voice recognition? Saw it a lot in last time. Like here: bleepingcomputer.com/news/security/… – Serverfrog Mar 15 '17 at 16:45
  • @Serverfrog good point to bring up, I know google is currently working on reCaptcha version 3 which will solve the issue because i believe it won't have the audio option such as version 2. I think this attack is pretty complicated and will deter any script kiddies. But it is a valid point to bring up and hopefully Google will fix this. But there are other "reCaptcha" libraries to use out there that don't include the audio/microphone option – nd510 Mar 15 '17 at 16:52
  • Wait, what? If an attacker had my e-mail and password? You mean if he has access to my e-mail account?? – Protector one Mar 15 '17 at 18:25
  • 1
    @Protectorone yes sorry, if he had access to your email account – nd510 Mar 15 '17 at 18:27
  • I see your point now. Good! But I'm not sure if this is enough of an issue to advise against it. I mean, if an attacker has control of my e-mail account, I'm already in trouble. – Protector one Mar 15 '17 at 18:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.