1

Similar to another question about keeping an account locked, is it preferable to allow a user to reset their password while the account is locked out due to the wrong password being used too many times?

For example, their account gets locked for 30 mins if the wrong password is used 6 times in a row. While the account is locked, they hit the "Forgot password" link. Should they be allowed to reset their password, or do I say the account is currently locked and can't be reset?

Improve this question

1 Answer 1

Reset to default
1

With the forgot password link your user can prove to have access to "something you have".

I would allow the reset of the account but would check more details like access to a second authentication factor (U2F, SMS, phone call, recovery codes).

You should also moderate this account. Only allow basic interaction and force additional authentication / admin approval / time delay / lock account when potential malicious behavior is detected after login (e.g. deleting settings, changing emails). So the real user would have time to react and there is also a message trail that something fishy is going on.

When the account would stay locked, an attacker could deny the real user to access the service by entering wrong passwords (denial of service).

Improve this answer
2
  • Sounds reasonable. What's to stop the bad actor from entering more bad passwords and locking the account again, potentially a slightly different denial of service?
    – 8BitCoder
    Jan 16, 2021 at 22:32
  • This surely is an annoyance that can be mitigated by forcing 2FA during login. Without that, the user stays logged in for some time as the current session is already authenticated. When the attacker blocks the account again, the user must reset the password before being allowed to login again.
    – Reiner Rottmann
    Jan 17, 2021 at 20:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .