Questions tagged [account-lockout]
The account-lockout tag has no usage guidance.
38
questions
0
votes
0
answers
59
views
Two-Factor authentication bypass
I use two-factor authentication where possible, I was always under the impression that not only it prevents brute-force attacks, but makes it safer to use my accounts in untrusted environments.
I ...
- 101
0
votes
0
answers
50
views
Should I let administrator account bypass IP ACL?
Let's say there is a system that can set IP ACL for security.
If administrator can't bypass IP ACL, account may by locked up when machine or network IP changed
But if administrator can bypass IP ACL, ...
- 101
0
votes
2
answers
266
views
Revoke all refresh tokens when account locked?
Scenario: a user enters his password incorrectly x times, so his account is locked for y minutes.
Should I revoke all his refresh tokens?
Problems:
user is logged out of all devices, not just the one ...
- 435
6
votes
3
answers
5k
views
Friend's Instagram account repeatedly hacked despite changing all information and enabling 2FA
My friends Instagram account has repeatedly been hacked. Someone is gaining access to her account, proceeding to change all the security information to lock her out. Then posts scam ads on her account....
- 61
0
votes
1
answer
113
views
New gateway results in Google and Amazon security lockout, "device not recognized"
The cable company recently replaced my old gateway/wireless router. After the new gateway was installed (a "Touchstone TG1682G Telephony Gateway", if it matters), both Google and Amazon required ...
- 521
2
votes
1
answer
241
views
Is it ok to let someone unlock their own account with their admin account?
Scenario:
Person A's normal computer account is personA. They have locked this out with too many bad password attempts.
The user is part of the IT group, so they also have an admin account: personA-...
- 21
0
votes
2
answers
251
views
What are the security practice or case studies for account lockouts?
We have a platform where users can sign up for free using their email addresses (they can also associate social media account). Other than the name, email and social account there no other personal ...
- 101
0
votes
3
answers
1k
views
Can a password change via CSRF lead to account takeover?
If a website has a password change functionality where the user isn't prompted for the current password and the form isn't using tokens to mitigate CSRF attacks, an attacker can easily execute a CSRF ...
- 1,378
1
vote
0
answers
126
views
Authentication: E-mailing security codes vs clickable links
I've noticed a trend in how big companies (Amazon, Skype, and a few others I don't remember in particular) handle e-mail authentication.
Rather than e-mailing clickable links with some single-use ...
- 158
2
votes
1
answer
874
views
Facebook security algorithm: Locked out of my own account after resetting password
I created a secondary Facebook account months ago from Argentina. Now I logged back in, and noticed countless logins from RUSSIA and the account is clearly being used by some Russian dude.
I logged ...
- 121
2
votes
2
answers
2k
views
Account lockout to protect from brute force: doesn't it open up vulnerabilities to DOS attacks? [duplicate]
AFAIK the recommended practice to mitigate brute force attacks is to lock an account down for, say, 15 min (perhaps escalating lockout time if the attack continues afterwards?) after, say, 5 failed ...
- 5,747
9
votes
2
answers
386
views
Are FIDO U2F keys (like dual Yubikeys or dual Google Titan keys) undermined by the Google account recovery process?
According to the Google information page here: https://support.google.com/accounts/answer/6103523
If you don’t have another second step or forgot your password
Note:
2-Step Verification requires an ...
- 220
0
votes
1
answer
149
views
Is any plaintext stored as a password hash an effective way to lock out an account?
I'm building a web app with Flask and I have user accounts that store their passwords in a MySQL String column using werkzeug.security's generate_password_hash() method. I wanted to create a Community ...
- 307
2
votes
2
answers
922
views
In which cases you should block a user after a certain number of failed attempts?
I have a web app. Existing users can invite new users by sending a mail throw the web app.
If the user fails 4 consecutive times I block the acount for 5 minutes.
Currently there is no important ...
- 123
0
votes
1
answer
333
views
Recovering locked-out accounts after losing smartphone
Ok so, we've got a situation here that sounds a bit hopeless, but it's happening right now and we could really use some help. Please bear with me here as I try to explain...
Recently, my wife and I ...
- 19
0
votes
0
answers
93
views
Policy for regaining access to a colleague's account
I run a SaaS used by teams to collect company-related information (think something like Crashlytics). Even if the tool lets users invite their colleagues, we often find cases of individuals who ...
- 283
4
votes
1
answer
8k
views
Should user account be locked after X amount of failed logins?
I have almost finished developing my login system and there is one more thing that I'm not sure about. So many debates I found on the internet about counting invalid logins and locking users account. ...
- 141
57
votes
8
answers
19k
views
Brutalized VPS recovery data now available. Considerations? [closed]
Backstory
My sites and VPS were stolen from me. The hosting company and I were locked out and unable to access it. They weren't able to create a temp password for access because the attacker blocked ...
- 613
7
votes
1
answer
150
views
Rationale for security lockout after changing a password
I was recently locked out of an account (for 30 minutes), not for failing a certain number of attempts at a password, but instead for changing the password after answering security questions.
What ...
0
votes
1
answer
103
views
Shell idle log out time best practice?
I am following CIS hardening best practices and it states that the log out time for shell is 60 seconds. This seems pretty steep for non production environments, is there any other best practise ...
- 327
0
votes
2
answers
556
views
How to prevent getting locked out of gmail with a dynamic IP? [closed]
My ISP recently changed the range of IPs they assign to customers which triggered gmails "hacker alarm" or something and prevents me from logging in.
The recovery options they provide (recovery mail ...
1
vote
1
answer
120
views
Securing information on password attempts
Let us say I am creating a program that works offline so password information needs to be stored locally (I know, not optimal, but this is just a personal project of mine). In terms of keeping the ...
- 113
1
vote
2
answers
10k
views
Account lockout policy guidelines [closed]
Edit: As I am asked to clarify this question I will state it in one sentence: What is a good lockout policy for web applications, why, on what does it depend?
It is hard to find a best practice ...
- 1,820
1
vote
2
answers
168
views
How to proceed after attempted cracking to accounts? [closed]
I was woken today at 05:15 by a phone call from my bank, notifying me that the PIN number is XXXX. I did not ask to change my PIN number, and actually, have not accessed the bank account ...
- 121
71
votes
6
answers
15k
views
Can a malicious actor lock the real user out by deliberately trying incorrect passwords every X minutes?
Some websites lock out a user after a series of incorrect password attempts for example for 15 minutes. If a malicious actor knows this, can they deliberately try logging in with incorrect passwords ...
- 875
1
vote
2
answers
358
views
Policy implications of changing passwords versus disabling accounts in Active Directory
Is there any guidance stating that the best way to handle leavers is to disable accounts (at least initially) instead of changing passwords? Given that AD supports this option I would assume this is ...
- 111
1
vote
2
answers
253
views
Website using Windows integrated - can user get locked out
I have a website that the IIS folder is set to Windows, that's the windows integrated authentication. It is available from the reverse proxy so any Internet user can access the URL. They then get ...
- 65
-1
votes
1
answer
165
views
Credentials After User Locked Out
I'm implementing lockout functionality for a web app where it checks if the user isn't logged in any more or if the user clicks the lockout link, they have to log in again. In some cases (like in ...
- 761
1
vote
1
answer
198
views
Should Lockout Terminate The Session?
I think it is OK not to terminate existing sessions if user is locked out due to a number of login attempts with the wrong password. Because it might be an attack and it would be inconvenient to ...
- 741
6
votes
2
answers
1k
views
Best practices for handling wrong TOTP tokens
Assume a 2FA system with user-supplied passwords and 6 digit TOTP tokens. It is not possible to test a TOTP token without authenticating with a password first, so whoever submits a token is presumed ...
- 201
0
votes
3
answers
252
views
Is there a way to answer security questions privately while in public?
Is there a strategy for answering security questions via telephone modestly securely while in an insecure environment? For example: I am at a coffee shop and am locked out of my account, I call the ...
- 3,632
0
votes
1
answer
207
views
Discovered a security flaw in a company, what to do? [duplicate]
While playing with a site I have discovered a huge security problem. The thing is, if I tell them about it they might question what was I doing in the first place.
I was trying to hack my friends ...
6
votes
1
answer
534
views
Desktop Flickers Past Lock Screen
I'm using Fedora 22 with Gnome 3. I have a password set for my user account, so when my laptop awakens from sleep, I am presented with the lock screen and must enter my password before getting to my ...
- 153
11
votes
4
answers
2k
views
What are the drawbacks of login request throttling?
In a web application, one way to protect against password guessing attacks is to lock out accounts after a set number of failed logins. This could be done on both source IP address and username.
For ...
- 34k
1
vote
1
answer
175
views
Limiting Login Attempts [duplicate]
I have to set up a server that will allow remote logins. Obviously security is an issue. In this first pass we are discussing:-
Locking a person for 15 minutes if they fail to login correctly three ...
- 111
2
votes
1
answer
892
views
How to suspend a silent oberserver from Facebook account?
A friend of mine told me about the following problem: She used to login on Facebook on a computer of her boyfriend. After they broke up she recognized that he was able to login to her account from his ...
- 129
4
votes
3
answers
2k
views
Should a user be able unlock his own account after being automatically locked out?
Should a user be able to unlock his own account after being locked out?
Typically there are requirements that specify that users are to be automatically locked out:
The user's account should be ...
- 141
1
vote
1
answer
135
views
Locking an enterprise account from an internet facing application
Some corporate applications are most useful when they are accessible from the internet. Outlook Web Access comes to mind.
Those application usually have a user directory (usually LDAP) in the ...
- 1,932