0

Suppose Alice isn't able to break into Bob's email account, but Alice can still do damage to Bob (a VIP) if she can stop him from being able to use his own email (or any other online) account to send and receive important emails.

So what she does is she writes a computer script that guesses a random password (since most email addresses have the same username) so that it locks her out. Could this also lock Bob out?

What if instead of one or two computers, she goes on the black market and uses thousands of bot computers around the nation to target Bob's account? Or she manages to hack Bob's wifi network so she even has the same IP address? What's there to stop Alice from making sure Bob never gets to use his own account ever again? (Besides two-factor authentication, which most people don't use.)

  • 3
    If you are asking about Gmail then the answer is: CAPTCHA – Ulkoma Jan 28 '15 at 7:46
3

Essentially you're just talking about a very targeted Denial-of-Service. There would be plenty of ways to achieve this other than just locking out their account. If they were on the same network then there would be plenty of other ways to do it other than just locking out someones account

1

Could this also lock Bob out?

Yes.

What if instead of one or two computers, she goes on the black market and uses thousands of bot computers around the nation to target Bob's account?

Bob is going to have a bad day / week / month / year. (unless, see subsection 4)

Or she manages to hack Bob's wifi network so she even has the same IP address?

I would be more concerned about Alice being on Bob's local network and exploiting vulnerabilities on his LAN. The fact that Alice has Bob's NAT'ed IP would have little bearing unless.....

What's there to stop Alice from making sure Bob never gets to use his own account ever again?

The webmail system in question employs stronger authentication. Even then, the NAT'd IP is only a single piece of the information that is collected to determine if it truly is Bob.

Many popular webmail sites have systems/code in place to detect such attacks and will require, for example, a captcha phrase to be entered before allowing the password to post.

Sometimes instead they may require a "secret question" to be answered before posting the password.

The same protections employed to prevent brute force attacks against guessing a password also help to mitigate nefarious individuals from intentionally locking out the account.

  • So what would be some ways for Alice to defend herself if Bob had a small team that would make the captcha useless and could answer the secret question? Would Gmail protect the average (computer illiterate) user from this attack if they didn't set up any special security measures beforehand? – user3272992 Jan 29 '15 at 18:12
  • I think you meant to say, how would Bob defend himself if Alice had a small team. ;) The best way to mitigate this attack if there is a small team willing to enter captchas would be to enable 2 factor authentication for the account. It's actually very easy to configure and use, and would prevent all the scenarios outlined above from being successful. – k1DBLITZ Jan 29 '15 at 20:52
  • Could adding a recovery phone also provide the same protection? 2 step verification can be a hassle – genealogyxie Jul 11 '16 at 5:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.