Questions tagged [account-lockout]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers

Two-Factor authentication bypass

I use two-factor authentication where possible, I was always under the impression that not only it prevents brute-force attacks, but makes it safer to use my accounts in untrusted environments. I ...
week's user avatar
  • 101
0 votes
0 answers

Should I let administrator account bypass IP ACL?

Let's say there is a system that can set IP ACL for security. If administrator can't bypass IP ACL, account may by locked up when machine or network IP changed But if administrator can bypass IP ACL, ...
Seongbok Youn's user avatar
0 votes
2 answers

Revoke all refresh tokens when account locked?

Scenario: a user enters his password incorrectly x times, so his account is locked for y minutes. Should I revoke all his refresh tokens? Problems: user is logged out of all devices, not just the one ...
lonix's user avatar
  • 435
6 votes
3 answers

Friend's Instagram account repeatedly hacked despite changing all information and enabling 2FA

My friends Instagram account has repeatedly been hacked. Someone is gaining access to her account, proceeding to change all the security information to lock her out. Then posts scam ads on her account....
user275680's user avatar
0 votes
1 answer

New gateway results in Google and Amazon security lockout, "device not recognized"

The cable company recently replaced my old gateway/wireless router. After the new gateway was installed (a "Touchstone TG1682G Telephony Gateway", if it matters), both Google and Amazon required ...
fuzzydrawrings's user avatar
2 votes
1 answer

Is it ok to let someone unlock their own account with their admin account?

Scenario: Person A's normal computer account is personA. They have locked this out with too many bad password attempts. The user is part of the IT group, so they also have an admin account: personA-...
BeckyG's user avatar
  • 21
0 votes
2 answers

What are the security practice or case studies for account lockouts?

We have a platform where users can sign up for free using their email addresses (they can also associate social media account). Other than the name, email and social account there no other personal ...
shobhonk's user avatar
  • 101
0 votes
3 answers

Can a password change via CSRF lead to account takeover?

If a website has a password change functionality where the user isn't prompted for the current password and the form isn't using tokens to mitigate CSRF attacks, an attacker can easily execute a CSRF ...
HorstKevin's user avatar
  • 1,378
1 vote
0 answers

Authentication: E-mailing security codes vs clickable links

I've noticed a trend in how big companies (Amazon, Skype, and a few others I don't remember in particular) handle e-mail authentication. Rather than e-mailing clickable links with some single-use ...
Alexander's user avatar
  • 158
2 votes
1 answer

Facebook security algorithm: Locked out of my own account after resetting password

I created a secondary Facebook account months ago from Argentina. Now I logged back in, and noticed countless logins from RUSSIA and the account is clearly being used by some Russian dude. I logged ...
andreszs's user avatar
  • 121
2 votes
2 answers

Account lockout to protect from brute force: doesn't it open up vulnerabilities to DOS attacks? [duplicate]

AFAIK the recommended practice to mitigate brute force attacks is to lock an account down for, say, 15 min (perhaps escalating lockout time if the attack continues afterwards?) after, say, 5 failed ...
gaazkam's user avatar
  • 5,747
9 votes
2 answers

Are FIDO U2F keys (like dual Yubikeys or dual Google Titan keys) undermined by the Google account recovery process?

According to the Google information page here: If you don’t have another second step or forgot your password Note: 2-Step Verification requires an ...
knaccc's user avatar
  • 220
0 votes
1 answer

Is any plaintext stored as a password hash an effective way to lock out an account?

I'm building a web app with Flask and I have user accounts that store their passwords in a MySQL String column using's generate_password_hash() method. I wanted to create a Community ...
mas's user avatar
  • 307
2 votes
2 answers

In which cases you should block a user after a certain number of failed attempts?

I have a web app. Existing users can invite new users by sending a mail throw the web app. If the user fails 4 consecutive times I block the acount for 5 minutes. Currently there is no important ...
Emilio Platzer's user avatar
0 votes
1 answer

Recovering locked-out accounts after losing smartphone

Ok so, we've got a situation here that sounds a bit hopeless, but it's happening right now and we could really use some help. Please bear with me here as I try to explain... Recently, my wife and I ...
FoxEM's user avatar
  • 19
0 votes
0 answers

Policy for regaining access to a colleague's account

I run a SaaS used by teams to collect company-related information (think something like Crashlytics). Even if the tool lets users invite their colleagues, we often find cases of individuals who ...
gimix's user avatar
  • 283
4 votes
1 answer

Should user account be locked after X amount of failed logins?

I have almost finished developing my login system and there is one more thing that I'm not sure about. So many debates I found on the internet about counting invalid logins and locking users account. ...
espresso_coffee's user avatar
57 votes
8 answers

Brutalized VPS recovery data now available. Considerations? [closed]

Backstory My sites and VPS were stolen from me. The hosting company and I were locked out and unable to access it. They weren't able to create a temp password for access because the attacker blocked ...
Preston Bennett's user avatar
7 votes
1 answer

Rationale for security lockout after changing a password

I was recently locked out of an account (for 30 minutes), not for failing a certain number of attempts at a password, but instead for changing the password after answering security questions. What ...
Andy Xahir Sirois's user avatar
0 votes
1 answer

Shell idle log out time best practice?

I am following CIS hardening best practices and it states that the log out time for shell is 60 seconds. This seems pretty steep for non production environments, is there any other best practise ...
Chri3's user avatar
  • 327
0 votes
2 answers

How to prevent getting locked out of gmail with a dynamic IP? [closed]

My ISP recently changed the range of IPs they assign to customers which triggered gmails "hacker alarm" or something and prevents me from logging in. The recovery options they provide (recovery mail ...
user149247's user avatar
1 vote
1 answer

Securing information on password attempts

Let us say I am creating a program that works offline so password information needs to be stored locally (I know, not optimal, but this is just a personal project of mine). In terms of keeping the ...
ERK's user avatar
  • 113
1 vote
2 answers

Account lockout policy guidelines [closed]

Edit: As I am asked to clarify this question I will state it in one sentence: What is a good lockout policy for web applications, why, on what does it depend? It is hard to find a best practice ...
Silver's user avatar
  • 1,820
1 vote
2 answers

How to proceed after attempted cracking to accounts? [closed]

I was woken today at 05:15 by a phone call from my bank, notifying me that the PIN number is XXXX. I did not ask to change my PIN number, and actually, have not accessed the bank account ...
boardrider's user avatar
71 votes
6 answers

Can a malicious actor lock the real user out by deliberately trying incorrect passwords every X minutes?

Some websites lock out a user after a series of incorrect password attempts for example for 15 minutes. If a malicious actor knows this, can they deliberately try logging in with incorrect passwords ...
yeti's user avatar
  • 875
1 vote
2 answers

Policy implications of changing passwords versus disabling accounts in Active Directory

Is there any guidance stating that the best way to handle leavers is to disable accounts (at least initially) instead of changing passwords? Given that AD supports this option I would assume this is ...
Brian Lyttle's user avatar
1 vote
2 answers

Website using Windows integrated - can user get locked out

I have a website that the IIS folder is set to Windows, that's the windows integrated authentication. It is available from the reverse proxy so any Internet user can access the URL. They then get ...
j. doe's user avatar
  • 65
-1 votes
1 answer

Credentials After User Locked Out

I'm implementing lockout functionality for a web app where it checks if the user isn't logged in any more or if the user clicks the lockout link, they have to log in again. In some cases (like in ...
SameOldNick's user avatar
1 vote
1 answer

Should Lockout Terminate The Session?

I think it is OK not to terminate existing sessions if user is locked out due to a number of login attempts with the wrong password. Because it might be an attack and it would be inconvenient to ...
John L.'s user avatar
  • 741
6 votes
2 answers

Best practices for handling wrong TOTP tokens

Assume a 2FA system with user-supplied passwords and 6 digit TOTP tokens. It is not possible to test a TOTP token without authenticating with a password first, so whoever submits a token is presumed ...
Jirka Hanika's user avatar
0 votes
3 answers

Is there a way to answer security questions privately while in public?

Is there a strategy for answering security questions via telephone modestly securely while in an insecure environment? For example: I am at a coffee shop and am locked out of my account, I call the ...
Matthew Peters's user avatar
0 votes
1 answer

Discovered a security flaw in a company, what to do? [duplicate]

While playing with a site I have discovered a huge security problem. The thing is, if I tell them about it they might question what was I doing in the first place. I was trying to hack my friends ...
user84187's user avatar
6 votes
1 answer

Desktop Flickers Past Lock Screen

I'm using Fedora 22 with Gnome 3. I have a password set for my user account, so when my laptop awakens from sleep, I am presented with the lock screen and must enter my password before getting to my ...
Woodrow Barlow's user avatar
11 votes
4 answers

What are the drawbacks of login request throttling?

In a web application, one way to protect against password guessing attacks is to lock out accounts after a set number of failed logins. This could be done on both source IP address and username. For ...
SilverlightFox's user avatar
1 vote
1 answer

Limiting Login Attempts [duplicate]

I have to set up a server that will allow remote logins. Obviously security is an issue. In this first pass we are discussing:- Locking a person for 15 minutes if they fail to login correctly three ...
MichaelJohn's user avatar
2 votes
1 answer

How to suspend a silent oberserver from Facebook account?

A friend of mine told me about the following problem: She used to login on Facebook on a computer of her boyfriend. After they broke up she recognized that he was able to login to her account from his ...
fiscblog's user avatar
  • 129
4 votes
3 answers

Should a user be able unlock his own account after being automatically locked out?

Should a user be able to unlock his own account after being locked out? Typically there are requirements that specify that users are to be automatically locked out: The user's account should be ...
Ken Liu's user avatar
  • 141
1 vote
1 answer

Locking an enterprise account from an internet facing application

Some corporate applications are most useful when they are accessible from the internet. Outlook Web Access comes to mind. Those application usually have a user directory (usually LDAP) in the ...
ixe013's user avatar
  • 1,932