This is the blog of Adam Kalsey. Unusual depth and complexity. Rich, full body with a hint of nutty earthiness.
Freshness Warning
This blog post is over 19 years old. It's possible that the information you read below isn't current and the links no longer work.
21 Jan 2004
Simon Willison proposes some ideas for securing authentication systems for Web-based applications and brings up a point that I’ve never thought much about. If you have a system that locks out a user after too many incorrect logins, then it becomes easy for a malicious user to deny access to your users by simply attempting to log in as them.
This doesn’t apply only to malicious users, however. Apparently there’s a host of people who think that they registered on eBay using my user name. Several times each month I get a notice from eBay that indicates I’ve asked to change my password. Someone probably can’t remember their account details and tries several username and password combinations, requesting a password reset for each of them.
If banning is a bad idea, then how do you defend against a brute-force dictionary attack on your site? Simon goes on to suggest a series of alternatives, listing the pros and cons of each. One thing that needs to be mentioned, however, is that your security approach should be appropriate for the value of information that is being secured.
A banking site needs a lot more security than a membership-based newsletter site. So locking out the account of a user might be acceptable for your bank, even though it would be silly for securing your vacation photos.
I’d like to see a system that reacts to a hack attack intelligently combining several of Simon’s approaches with some other ideas.
Simon said:
Ban login requests from the attacker’s IP address. This introduces the usual problems with IP banning, namely the risk of banning a whole bunch of people indiscriminately but leaving the attacker free to skip the ban using open web proxies.
You could use temporary banning to make life difficult for the attacker. After 40 consecutive invalid logins on the same user account over a period of time, ban the source IP addresses of the last few attempts for a few minutes. Instead of taking a few hours to break an account, it would then take several days. And the impact to real users would be minimal.
Lock the user’s account and email them a warning of the attack and a special key needed to unlock the account again.
This special key would also be vulnerable to a dictionary attack. You can mitigate this concern by issuing new keys as the attack continues. Each time an account has a certain number of invalid logins, change the key and resend it. It’s hard to brute-force a constantly changing key.
For systems that don’t need a high level of security, instead of creating a special key, you could actually reset the password to a random string and email it to the user. The attacker now has a moving target to crack.
Send an automated alert to a system administrator so they can analyze the situation in real time and take any necessary action. This relies on administrators being available 24/7 - hardly a safe assumption for most systems.
If you’ve slowed down the attacker as noted above, this becomes a viable option.
Other interesting (and perhaps half-baked) options would be:
Excerpt: Both Simon Willison and Adam Kalsey have made excellent posts about authentication security. This has come at a very appropriate time as Mike and I are developing an admin panel for SC3 just now. I'll definitely be implementing a delay...
"After 40 consecutive invalid logins on the same user account over a period of time, ban the source IP addresses of the last few attempts for a few minutes." I really like this approach. The company that holds my mortgage has a draconian approach to locking out users. If you don't log in with the correct password within three tries, you are locked out for 24 hours. I've done this to my account several times. I've even mistakenly typed in the wrong username and locked out another's account. They will let you call an 800 number to unlock the account, but to me, that really ruins the purpose of the web. If I wanted to call an 800 number, I wouldn't have even bothered with the website.
This discussion has been closed.
Roland
January 22, 2004 3:43 AM
Displaying the time and date of last few logins may be usefull to detect if a login/password has been compromised without triggering an alert.