Hacker News Reader

Comment by ransom1538 | Hacker News Reader

Stupid question here. But shouldn't websites/apps simply lock the account for 5 minutes after 3 bad password attempts? -- basically ending the usefulness of bad password lists, etc etc. Do sites actually let you run limitless password attempts -- thus really find these password lists important? If your password was "foofoo", and there was a password lock after 3 attempts I don't see how you would crack it with a password file (in this lifetime).

View on HN

A lot of sites don't want to lock you out because that is a denial of service vector. If someone wanted to mess with your site, especially if your usernames are public (like reddit, eBay, HN, etc), then all they have to do is keeping sending login requests with bogus passwords to lock out all of your users.

I've tried that once in a site and it was a maintenance nightmare. Users kept bombarding me with emails asking to unlock their accounts. Turns out 99 times out of 100 that a username/password combo has been mistyped it's from users jerking around or not remembering the password, rather from hackers trying to brute force their entrance.

Now imagine having a site with a few million accounts and 0,1% of them mistyping the password every now and then.

You don't have a 'forgot password' system?

One could set the threshold to 40 failed attempts. brute forcing requires thousands of attempts.

Sounds like a case of not handling the UX of the feature properly. What you can do is either allow them to unlock the account via email, or have a time-based unlock, or both. We do 72 hours or unlock it via email.

As someone explained in a different comment above, modern exploit scripts will just rotate around through the entire database, trying different userid’s in series to avoid hitting rate limits per userid. Most criminals don’t actually care WHOSE account they hack, as long as they can get some monetary or data value out of any hacked account.

And, if you do a hard lock-out, that’s an easy way for an attacker to DoS your entire user base in short order.

Because the email/password combination is already known. From a previous breach where you used the same combination. So the attacker needs exactly 1 attempt to get into your account.

And with the ease of using botnets now, they can get access to a very large number of IPs to distribute the attack, so you can't reliably throttle at IP level either.

I think it’s more common to crack the passwords offline from a breach. Enough people reuse passwords that you can then directly try a persons password on multiple sites, without the need to guess.

I think I’ve had this happen to a few old accounts of mine that reused a simple password that had been leaked. (Of course I can’t really verify how the hackers did it, but it seems likely to me)

Seems like there are some legitmate reasonings in this thread. I also wonder how much of it is just not wanting to explain making it potentially more difficult for a user to log in.

Sort of like how credit card providers could make things much more secure but choose not to because of fear of reducing transactions.

Reply on news.ycombinator.com