9

Lets use Google Authenticator as example. A 6 digit code is generated every 30 second. Each random attempt has 1/1,000,000 chance of success.

Server will usually accept code of ±30s which increased the chance of each attempt to 3/1,000,000

If the attacker tries one code every min for 200 days then he/she will have 92.5% chance of breaking the system.

What are some counter measures that big companies like Google/Amazon/Facebook/Twitter/Microsoft use to mitigate this issue?

Improve this question
5
  • 4
    First mitigation is throttling. After a few failed tries, it goes from being able to guess once per minute to being able to guess once every 15 minutes. Your 200 days goes to 3,000 days. Next mitigation is logging when accounts and IPs get throttled, and when something is consistently throttled, let a human (account owner, admin, etc.) know that someone is actively attacking.
    – Ghedipunk
    Commented Jul 29, 2019 at 20:22
  • See also Two factor brute force protection.
    – Sjoerd
    Commented Jul 30, 2019 at 8:43
  • See also Best practices for handling wrong TOTP tokens
    – Sjoerd
    Commented Jul 30, 2019 at 8:46
  • @Sjoerd I'm afraid that your two linked answers do not help against the specific attack described here.
    – A. Hersean
    Commented Jul 31, 2019 at 16:34
  • First mitigation is the first factor :)
    – eckes
    Commented Aug 1, 2019 at 1:01

1 Answer 1

Reset to default
3

Consecutive failures on an account since last success should be a red flag.

Increasing lockout time for attempts from devices new to that user might have value.

If the account is consistently being rejected at the 2nd factor then you can presume that the password has been compromised and reach out to the user.

In any case, pay attention to consecutive failures.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .