Some websites lock out a user after a series of incorrect password attempts for example for 15 minutes. If a malicious actor knows this, can they deliberately try logging in with incorrect passwords every 15 minutes to prevent the real person from logging in? Is this a real threat and if so how can websites protect against it?
Login brute-force protection can be enforced in three ways:
- Temporary Lockout
- Permanent Lockout
In my perspective, CAPTCHA is the most reasonable solution to avoid the risk of bruteforce as well as denial of service due to account lockout. You might have seen a CAPTCHA appearing on the login pages of Facebook and Gmail in case you enter wrong password more than three or four times. That's a decent way of restricting bots from bruteforcing and at the same time avoiding locking users out.
Permanent lockout is not a novel solution, and it adds a lot of operational overhead to customer support team if they have to manually unlock the account for the user. Temporary lockout on the other hand deter bruteforcing, but like the scenario you mentioned, it can lock out a genuine user.
Yes, some websites do that in order to prevent bruteforce or password guessing attacks. Instead of banning the user, the website should ban the IP address from accessing the website.
If the attacker is hopping from one IP address to another and doing the brute force attack, then in that case the website can ban the user id and notify the banned user through email or some other way or may be banning the user for a short duration of time will also do the needful.
Other answerers have already offered some valuable means by which a website can prevent abuse of anti-password-guessing measures to lock people out. Here is another one: IP whitelisting.
@Skynet already suggested blacklisting , but with attackers nowadays being able to build botnets well over a million devices in size, that might not be very effective against a resourceful attacker. (Note that an attacker wouldn't necessary have to build such a botnet themselves: many cybercrooks rent out access to their bots.)
So whilst blacklisting could offer a defense against a less powerful attacker, if an attack scales up to a large number of IP addresses, an alternative would be to try to restrict access to IP addresses which have previously been used to successfully log in to the account.
Of course, care still needs to be taken: if an attacker has access to a device that uses a whitelisted IP address, a website should look to ensure this will not allow the attacker to escape brute-force detection. Also, since a user may have a dynamic IP address or for some other reason try to login from a new IP, there needs to be some alternate mechanism by which the user can bypass the login blocking, such as:
- By entering a CAPTCHA (though be warned: a determined attacker could hire people to solve these at a surprisingly low price);
- Clicking a link in an e-mail (you'll also want to build in some checks to prevent this from being abused to flood people's inboxes); or
- Using some kind of two-factor authentication to prove that they are the legitimate owner of the account.
Yes and it has been done before. This can cause a big problem with certain websites. OWASP lists some examples of how it can go wrong on their page on Blocking Brute Force Attacks...
Account lockout is sometimes effective, but only in controlled environments or in cases where the risk is so great that even continuous DoS attacks are preferable to account compromise. In most cases, however, account lockout is insufficient for stopping brute-force attacks. Consider, for example, an auction site on which several bidders are fighting over the same item. If the auction Web site enforced account lockouts, one bidder could simply lock the others' accounts in the last minute of the auction, preventing them from submitting any winning bids. An attacker could use the same technique to block critical financial transactions or e-mail communications.
Yes, this is a real threat and is to be considered when you construct your brute-force defenses. These kinds of attacks have been conducted as well, so it's not purely theoretical.
Typically nowadays a system will provide a locked-out user with some means to reset his account, usually through a separate channel (mail, SMS, etc.)
Yes, it's possible. But it can be prevented using CAPTCHA, if the login form has it the only way to achieve this would be manually entering incorrect passwords and is a minor risk. The attacker must be really mad to spend his entire day locking your account
Also you should only indicate the account is locked when the user enters his credentials correctly to prevent account enumeration and never distinguish when the attacker enter the wrong password or if the user doesn't exist