Re: Account Lockouts

I wrote an article not too long ago 
(http://www.owasp.org/columns/mburnett/brutegeneral.html) that talks about the 
disadvantages of using account lockouts and suggests some countermeasures. 
Abusing account lockout is an interesting attack that I suspect might become 
more refined and more talked about in the future, but for now is largely 
neglected. For example, one could use selective account lockout to block others 
from time-sensitive transactions such as auction bids, financial transactions, 
critical e-mails, etc.


Mark Burnett



--------------------------------------------------------------------
Hacking The Code: ASP.NET Web Application Security
http://www.hackingthecode.com