Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Make your voice heard. Take the 2019 Developer Survey now

Questions tagged [account-lockout]

The tag has no usage guidance.

2
votes
1answer
64 views

Facebook security algorithm: Locked out of my own account after resetting password

I created a secondary Facebook account months ago from Argentina. Now I logged back in, and noticed countless logins from RUSSIA and the account is clearly being used by some Russian dude. I logged ...
2
votes
2answers
52 views

Account lockout to protect from brute force: doesn't it open up vulnerabilities to DOS attacks? [duplicate]

AFAIK the recommended practice to mitigate brute force attacks is to lock an account down for, say, 15 min (perhaps escalating lockout time if the attack continues afterwards?) after, say, 5 failed ...
7
votes
2answers
158 views

Are FIDO U2F keys (like dual Yubikeys or dual Google Titan keys) undermined by the Google account recovery process?

According to the Google information page here: https://support.google.com/accounts/answer/6103523 If you don’t have another second step or forgot your password Note: 2-Step Verification ...
0
votes
1answer
55 views

Is any plaintext stored as a password hash an effective way to lock out an account?

I'm building a web app with Flask and I have user accounts that store their passwords in a MySQL String column using werkzeug.security's generate_password_hash() method. I wanted to create a Community ...
1
vote
2answers
96 views

In which cases you should block a user after a certain number of failed attempts?

I have a web app. Existing users can invite new users by sending a mail throw the web app. If the user fails 4 consecutive times I block the acount for 5 minutes. Currently there is no important ...
0
votes
1answer
110 views

Recovering locked-out accounts after losing smartphone

Ok so, we've got a situation here that sounds a bit hopeless, but it's happening right now and we could really use some help. Please bear with me here as I try to explain... Recently, my wife and I ...
0
votes
0answers
46 views

Policy for regaining access to a colleague's account

I run a SaaS used by teams to collect company-related information (think something like Crashlytics). Even if the tool lets users invite their colleagues, we often find cases of individuals who ...
3
votes
1answer
2k views

Should user account be locked after X amount of failed logins?

I have almost finished developing my login system and there is one more thing that I'm not sure about. So many debates I found on the internet about counting invalid logins and locking users account. ...
57
votes
8answers
19k views

Brutalized VPS recovery data now available. Considerations? [closed]

Backstory My sites and VPS were stolen from me. The hosting company and I were locked out and unable to access it. They weren't able to create a temp password for access because the attacker blocked ...
0
votes
0answers
39 views

Login workflow for an occasionally used service

I'm creating an online service for companies to manage registration for annual events. Event attendees will need some way to login to the system to manage their booking, payment, special requests, ...
7
votes
1answer
94 views

Rationale for security lockout after changing a password

I was recently locked out of an account (for 30 minutes), not for failing a certain number of attempts at a password, but instead for changing the password after answering security questions. What ...
0
votes
1answer
46 views

Shell idle log out time best practice?

I am following CIS hardening best practices and it states that the log out time for shell is 60 seconds. This seems pretty steep for non production environments, is there any other best practise ...
0
votes
2answers
306 views

How to prevent getting locked out of gmail with a dynamic IP? [closed]

My ISP recently changed the range of IPs they assign to customers which triggered gmails "hacker alarm" or something and prevents me from logging in. The recovery options they provide (recovery mail ...
1
vote
1answer
53 views

Securing information on password attempts

Let us say I am creating a program that works offline so password information needs to be stored locally (I know, not optimal, but this is just a personal project of mine). In terms of keeping the ...
0
votes
2answers
4k views

Account lockout policy guidelines [closed]

Edit: As I am asked to clarify this question I will state it in one sentence: What is a good lockout policy for web applications, why, on what does it depend? It is hard to find a best practice ...
1
vote
2answers
111 views

How to proceed after attempted cracking to accounts? [closed]

I was woken today at 05:15 by a phone call from my bank, notifying me that the PIN number is XXXX. I did not ask to change my PIN number, and actually, have not accessed the bank account ...
69
votes
6answers
13k views

Can a malicious actor lock the real user out by deliberately trying incorrect passwords every X minutes?

Some websites lock out a user after a series of incorrect password attempts for example for 15 minutes. If a malicious actor knows this, can they deliberately try logging in with incorrect passwords ...
1
vote
2answers
41 views

Policy implications of changing passwords versus disabling accounts in Active Directory

Is there any guidance stating that the best way to handle leavers is to disable accounts (at least initially) instead of changing passwords? Given that AD supports this option I would assume this is ...
0
votes
0answers
181 views

Fail interval for account lockout using PAM

I want a user account to be locked for X seconds upon Y number of failed login attempts within a window of Z seconds on an Ubuntu system. Effectively, a user should be able to try logging in for Y-1 ...
1
vote
2answers
155 views

Website using Windows integrated - can user get locked out

I have a website that the IIS folder is set to Windows, that's the windows integrated authentication. It is available from the reverse proxy so any Internet user can access the URL. They then get ...
-1
votes
1answer
78 views

Credentials After User Locked Out

I'm implementing lockout functionality for a web app where it checks if the user isn't logged in any more or if the user clicks the lockout link, they have to log in again. In some cases (like in ...
1
vote
1answer
52 views

Should Lockout Terminate The Session?

I think it is OK not to terminate existing sessions if user is locked out due to a number of login attempts with the wrong password. Because it might be an attack and it would be inconvenient to ...
2
votes
1answer
280 views

Best practices for handling wrong TOTP tokens

Assume a 2FA system with user-supplied passwords and 6 digit TOTP tokens. It is not possible to test a TOTP token without authenticating with a password first, so whoever submits a token is presumed ...
0
votes
3answers
188 views

Is there a way to answer security questions privately while in public?

Is there a strategy for answering security questions via telephone modestly securely while in an insecure environment? For example: I am at a coffee shop and am locked out of my account, I call the ...
-1
votes
1answer
249 views

Can I be hacked on lock screen?

I left my Windows PC for 10 minutes, but I locked it, nobody knew my password, so I have one question: Is it possible that I am hacked by someone without shutdown computer on lock screen in 10 minute ...
0
votes
1answer
131 views

Discovered a security flaw in a company, what to do? [duplicate]

While playing with a site I have discovered a huge security problem. The thing is, if I tell them about it they might question what was I doing in the first place. I was trying to hack my friends ...
4
votes
1answer
354 views

Desktop Flickers Past Lock Screen

I'm using Fedora 22 with Gnome 3. I have a password set for my user account, so when my laptop awakens from sleep, I am presented with the lock screen and must enter my password before getting to my ...
11
votes
4answers
871 views

What are the drawbacks of login request throttling?

In a web application, one way to protect against password guessing attacks is to lock out accounts after a set number of failed logins. This could be done on both source IP address and username. For ...
1
vote
1answer
109 views

Limiting Login Attempts [duplicate]

I have to set up a server that will allow remote logins. Obviously security is an issue. In this first pass we are discussing:- Locking a person for 15 minutes if they fail to login correctly three ...
2
votes
1answer
578 views

How to suspend a silent oberserver from Facebook account?

A friend of mine told me about the following problem: She used to login on Facebook on a computer of her boyfriend. After they broke up she recognized that he was able to login to her account from his ...
4
votes
3answers
678 views

Should a user be able unlock his own account after being automatically locked out?

Should a user be able to unlock his own account after being locked out? Typically there are requirements that specify that users are to be automatically locked out: The user's account should be ...
1
vote
1answer
85 views

Locking an enterprise account from an internet facing application

Some corporate applications are most useful when they are accessible from the internet. Outlook Web Access comes to mind. Those application usually have a user directory (usually LDAP) in the ...