I'm having problems to fully understand how to prevent rapid-fire login attempts. My questions basically come from the The definitive guide to form-based website authentication.
The final recommendation is setting a login throttling, setting a time delay between failed attempts. Something as:
- 1 failed attempt = 5 sec delay
- 2 failed attempts = 15 sec delay
- 3+ failed attempts = 45 sec delay
A few questions that easily come to mind are:
If we're trying to protect our system from brute-force or dictionary attacks, how is it that the delays are so restrictive?. One of the examples shows an increase of 2**2 per invalid attempt. Wouldn't a fairly minor amount of time discourage already an automated attacker?.
In this protection scheme, what would be the client? How would it be identified?. Are we talking about an IP+account or just account?. If we are talking about just an account without taking into account the IP, isn't that likely to bother legitimate users trying to access their account?.
I have never seen any reading material talking about humans trying to access accounts?. I understand that this case would be highly unlikely (more if we assume password policies in place) but, what if an attacker has built a list of likely passwords via some method (social engineering). Shouldn't that be protected too?. Because in that case, and being the client identified by IP+account, being very restrictive would make a lot of sense, trying to block the IP that he is using.
How does throttling failed logins make a real difference between just simple throttling?. With simple throttling, I mean a throttle over the 'login' endpoint that controls the number of times that you try to log-in, but without taking into account if these attempts were successful or not.
Assuming this previous definition for what I meant with a simple throttle, let's assume that I am controlling the number of times that you can call the login endpoint for one account given a span of time:
- For each account, the login endpoint can be called 3 times each minute.
Would that be enough to stop a brute force attack?. Does adding this delay mentioned before when the attempt is invalid yield better results?.
I would be super grateful if anyone could shed some light here.