RE: Account Lockouts

> What are successfull techniques that could be used on the web 
> interface to avoid having a script run against it that would 
> potentially lock out 15000 user accounts, and create a 
> headache for the system administrators who have to manually 
> unlock each account?

A common variation is to brute force accounts rather than passwords.
i.e. pick a common weak password like "password" or "sex" or whatever,
then try that against every account just once (since you already know
the account names).  Because each account is only being tried once, no
lockouts.

S.   :)


This e-mail (and any attachments) may contain confidential information. If you 
are not the intended recipient, you must not disclose it or use the information 
contained in it. If you have received this e-mail in error, please tell us 
immediately by return e-mail, delete it from your system and destroy any 
copies.  Emails may be interfered with, may contain computer viruses or other 
defects and may not be successfully replicated on other systems. Brambles gives 
no warranties on these matters.