4

For context, my web app will be used by users who don't have a strong technical background. What are the pros or cons for displaying a message like this?

Something like:

enter image description here

4
  • No point in showing them. If you want to set up a block threshold just block them, don't let the attacker know. If you let the attacker know then they wont exceed the limit, in order to avoid tipping off an admin. – john doe Aug 13 '20 at 2:51
  • So what exactly happens after the attempt limit is reached? – user10216038 Aug 14 '20 at 3:29
  • 3
    @johndoe the attacker will know what the threshold is as soon as it is reached. Then adjust. "hiding" this information does nothing to stop an attacker. – schroeder May 10 at 7:36
  • 1
    It may also help attackers figure out if the lockout is per-user, per-IP, if it decrements after some time of inactivity, etc. So displaying the actual number of attempts remaining may be considered "information about the internal state of the server". However I think displaying a vague message about the policy is fine, ie "Accounts lock after 3 attempts". – Mike Ounsworth May 10 at 14:40
0

This looks like my bank. If I mistype the password, they warn me that my card will be blocked if I don't get it correct in the next 2 trials. And that increases my stress. I don't like that message.

I would not add that kind of message because it does not helps the user remember its password. If the user mistyped the password, they will hopefully get it correct on the next try, and if they forgot it they will get it wrong again on the next try.

For an attacker, it won't change much. Assuming they can create a user on your site, they can test themselves how many passwords they can try until they get blocked.

1
  • 1
    I disagree with the suggestion to hide it. If the user knows that they could lock themselves out, they might not be so cavalier with making stabs in the dark. It would reduce the calls in to unlock the account. Note that there is no "forgot password" feature in the screenshot. – schroeder May 10 at 14:38
0

Possible pros:

  • The user will understand they need to enter the password more carefully, to avoid getting blocked. It's like a warning. However 3 attempts is usually a very low limit, and if you raised it to 10 you wouldn't need to warn the user (because 10 wrong attempts won't be likely).

Possible cons:

  • An attacker might learn your limit before trying to trigger it, so they might avoid detection in this case, although it all depends on how your security controls are set up. However if your system is connected to the internet and is subject to opportunistic attacks (by bots), the limit will be triggered all the time anyway, so any useful detection based on a hidden limit might become infeasible.
  • The user will see a "scary" or annoying message, which might not be ideal for user experience.

In conclusion, from a security point of view it doesn't matter whether you show that message or not. From a UX (user experience) point of view though, it might be a better idea to hide it, and maybe raise the limit to 5 or more (depending on your needs, statistics about locked users, etc.).

3
  • 1
    I disagree with the suggestion to hide it. If the user knows that they could lock themselves out, they might not be so cavalier with making stabs in the dark. It would reduce the calls in to unlock the account. Note that there is no "forgot password" feature in the screenshot. – schroeder May 10 at 14:38
  • @schroeder, that's why I suggested increasing the limit a bit (maybe to 5 or more) to reduce the probability of false positives without affecting security in practice, and also noted that it depends on the OP's needs (statistics about actual false positives, options to reset password, resources dedicated to support, etc.). – reed May 11 at 9:49
  • 1
    Still. If I didn't know I would lock myself out, I might try 10 or more passwords. Since it doesn't hinder the attacker, a note is kind to legitimate users (and the service) – schroeder May 11 at 10:14
-1

Most large web applications lock accounts based off of a variety of metadata, not just number of recent failed login attempts. This is because the login procedure is really about minimizing false positives (users logging as others) and false negatives (users not being able to get into their account). This can include historical login data, attacker IP and location, user agents, and even user behavior.

You might not need to spend that amount of time building an auth portal, but you are effectively building a policy that manages the same goal. In order to find out how to make the tradeoff between those two things, you have to consider:

What would be the cost of a user account compromise? What would be the cost of a user getting locked out of their account?

Then think about your lockout policy and try to determine whether any given property is making the proper tradeoff. In your case, you'll have to think about how many of your users will trigger the block with vs. without the message, and how many attackers will do the same. Personally, I doubt that with a simple trigger like "number of recent attempts" you are really going to stop any targeted attacker from learning when the threshold is. The first thing I would do if I was starting to try massive amounts of logins on a website would be to attempt it on an account I own and see if anything happened.

1
  • This is an answer about the merits of blocking accounts based on attempts. This is not an answer to the question asked. – schroeder May 10 at 7:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.