Re: Account Lockouts

On Wed, 1 Dec 2004, Harrison Gladden wrote:
> 2) Create a set time-out period  for each account of  X (maybe an hour)

Unfortunately if somebody run that script just before begining of the working
day this hour will be really tough for the admin. Probably it is good idea to
make different timeouts for different number of failures, like, 5 seconds after
first, 10 seconds after second and, say, 3 minutes for all others (and never
lock accounts).

Note that no timeout method protects you from weak passwords: since in many
cases an attacker does not care whose password to obtain he can try 15000
different accounts with almost no risk of detection or lockouts.

-- 
Regards,
ASK