Account lockout with human interaction required to unlock

Question

I just got locked out yet again from my university's system for typing the wrong password twice, then mistyping the correct one by accident. Now I have to call the helpdesk or go there myself to reset it.

---

Now my question, is there really any value in doing this? I could understand a 5-15 minute lockout, but I simply do not see any value in a hard account lockdown from a security point of view. From my point of view as a user of this system, it has been nothing but trouble, frustration, and lots and lots of lost time.

If anything, this looks like a huge sign saying "lock this user's account FOR FREE!" simply by knowing their username, enabling mass denial of service with little effort. But I could be missing something.

Of course, I am obviously biased, so does anyone see an advantage in doing this? To me it looks like overzeal, and their other password policies - I will spare you the horror - really don't do a good job at making me feel good about giving them passwords, but I unfortunately have zero authority over this.

Answer 1

I agree - the hard account lockout can be used by malicious users to DoS (Denial of service) legitimate user accounts. Depending on the sensitivity of the user accounts a time based lockout may be more appropriate. For similar applications our company uses a time-based incrementing approach.

For example, the first time it locks out after 3 incorrect passwords it locks for 10 minutes. If it is locked again it locks for 20 minutes. The third time 40 minutes. And so on, this incrementing time makes it time consuming for automated brute force attempts and will give significant time to the sys admin / security team to identify an attack. Without the time based lockout a brute force attack would be possible in a number of minutes, and with the hard account lockout it would cause a headache for the support team.

One question would be can you easily enumerate usernames of the application. If you can then point this out to the support / development team as a malicious attacker could easily do the same and lock out every account in the system.

Answer 2

The Problem

Determining the threshold of your password policy is quite objective. Depending on how your authentication is setup, you can either have a low number of bad logon attempts (1-3) within a certain period of time and a higher administrative overhead or a higher number of bad logon attempts with lower administrative overhead.

---

Low bad logon attempts

Consider the example where a user only has 1-3 bad login attempts and they are locked out of the system. This minimizes the chance of a successful password attack and prevents almost any bruteforce attempt. This threshold provides the greatest security that you can achieve through bad logon attempts.

Only a few bad logon attempts will lock out the user and the account will be required to be unlocked before another logon attempt. This does make it easy to preform a DoS on yourself, your teacher, your boss, or your friend.

---

High bad logon attempts

A reasonable number of bad logon attempts over 5-10 is considered to be high. If a user needs 10 tries before they get the right password it is probably because of infrequent logons or they simply don't remember their password.

With higher bad logon attempts, there is a greater chance of success during a password attack. If the users type their password correct before the threshold, then there is no administrative overhead.

---

No Bad logon attempts

This is usually found when logging on a local system with no network authentication, like a home PC. In network authentication, this method is asking be subjected to a password attack.

Of course this will allow unlimited number of password attempts by anyone.

---

Administrative Overhead

Companies and organisations have to pay people to help with unlocking customers/employees accounts. The most common way is by using a password reset system through email. It costs money to develop, support, integrate, and maintain a system like this. However, it is quite cost effective to the other alternatives.

A help desk will help solve any problem that the email system cannot. If a user forgot the password of your site, maybe they forgot the password to their email password too!

---

Weaknesses

Large schools, banks, organisations can be targeted with a dictionary password attack. When there are more accounts, there is a better chance of a successful attack. And when you can attack an account many times before it is locked out, it has a greater chance of being compromised.

If the school UCLA has 40,000 students, you would expect some of the accounts may have passwords that include "UCLA", "bruins", "college", as well as weak passwords.

---

Conclusion

It is up to the managers, administrators, etc, to pick the password policy that fits their situation. Many things would be included in this decision and some are: cost of data loss, administrative overhead, cost of security, cost of potential down time.

Answer 3

Well, the coin has two sides.

The unlock interaction is there to have a trusted human — the help desk person — check that the person asking for unlock is really you. This can be done over the phone, by asking you some details… And this can be quick, provided that the help desk is open — here a 24/7 help desk comes in handy.

On the other hand, I hate when an account is locked for a given duration, say 15 minutes. If you really want to do something now, you cannot do anything, you cannot phone the right service, you have to wait 15 minutes. This is frustrating, and I find this more blocking.