Re: Account Lockouts

I assume you mean that your web app authenticates to your network?

It doesnt need to be so complicated - the web app alone could make a note of
failed logins and the time at which they happened, then decide whether or
not to authenticate the user even if they provide good credentials in the
future.

This information would eventually expire based on your timeout - and the
users would be allowed back on.  This data is worth keeping though of
course.

Ian

----- Original Message ----- 
From: "Harrison Gladden" <hgladden@gmail.com>
To: <webappsec@securityfocus.com>; <secprog@securityfocus.com>
Sent: Wednesday, December 01, 2004 5:52 PM
Subject: Account Lockouts


> My question to the group is about handling account lock outs.  Here's
> the situation, assume there is a web interface that lets users log in
> and do stuff, but the log-in process is constrained by the network
> restrictions as well.. Meaning if a user tries to log in X times in Y
> seconds and fails each time, then the account get locked out.
>
> What are successfull techniques that could be used on the web
> interface to avoid having a script run against it that would
> potentially lock out 15000 user accounts, and create a headache for
> the system administrators who have to manually unlock each account?

> Hopefully my question makes sense.