I have a web-based application where users can log on with username and password.
I just implemented a new account lockout feature and was wondering whether it makes sense or I totally screwed it up.
The first 3 invalid login attempts just show my standard:
Incorrect user name or password
but I store each failed attempt. For any further attempt, I lockout the account for more and more seconds and I show this to the user:
The logon failed because your account is blocked due to a previous unsuccessful attempt.
Please wait a 18 seconds and try again.
If the failed logon count is greater 10, I lockout the account for 120 seconds, that is the max wait time.
If the proper user finally remembers the correct password, she has to wait 2 minutes, that's not too bad.
But a hacker can only try a new password every 2 minutes, which soon becomes tiresome.
After a successful logon my failure-count is reset to zero.
All the numbers here are configurable.
Problems:
- After a few attempts, I disclose that a username is valid, by displaying a different message, but I could turn that off as well and always just display the standard message.
- If the real user tries to log on while someone else is trying to break into her account, she wont be able to log in, so this is a denial of service. But two minutes after the attacker gives up, she can log in without having to call the help-desk.