Collaborate Disseminate
Some websites lock out a user after a series of incorrect password attempts for example for 15 minutes. If a malicious actor knows this, can they deliberately try logging in with incorrect passwords every 15 minutes to preven… Continue reading Can a malicious actor lock the real user out by deliberately trying incorrect passwords every X minutes?
I restarted my laptop and now Bitdefender is asking me to change my password to a new one while trying to log onto the system itself. They want an older password that I do not have. I am unable to create a new password as wel… Continue reading Bitdefender locked me out of system
Is there any guidance stating that the best way to handle leavers is to disable accounts (at least initially) instead of changing passwords? Given that AD supports this option I would assume this is the only supported way to … Continue reading Policy implications of changing passwords versus disabling accounts in Active Directory
I want a user account to be locked for X seconds upon Y number of failed login attempts within a window of Z seconds on an Ubuntu system.
Effectively, a user should be able to try logging in for Y-1 times every Z seconds inde… Continue reading Fail interval for account lockout using PAM
I have a website that the IIS folder is set to Windows, that’s the windows integrated authentication. It is available from the reverse proxy so any Internet user can access the URL. They then get prompt for credentials. Suppo… Continue reading Website using Windows integrated – can user get locked out
I have a website that the IIS folder is set to Windows, that’s the windows integrated authentication. It is available from the reverse proxy so any Internet user can access the URL. They then get prompt for credentials. Suppo… Continue reading Website using Windows integrated – can user get locked out
I have a website that the IIS folder is set to Windows, that’s the windows integrated authentication. It is available from the reverse proxy so any Internet user can access the URL. They then get prompt for credentials. Suppo… Continue reading Website using Windows integrated – can user get locked out
I think it is OK not to terminate existing sessions if user is locked out due to a number of login attempts with the wrong password. Because it might be an attack and it would be inconvenient to terminate the existing session… Continue reading Should Lockout Terminate The Session?
Assume a 2FA system with user-supplied passwords and 6 digit TOTP tokens. It is not possible to test a TOTP token without authenticating with a password first, so whoever submits a token is presumed to know the password. Ea… Continue reading Best practices for handling wrong TOTP tokens