Re: Account Lockouts

I wrote an article not too long ago (http://www.owasp.org/columns/mburnett/brutegeneral.html) that talks about the disadvantages of using account lockouts and suggests some countermeasures. Abusing account lockout is an interesting attack that I suspect might become more refined and more talked about in the future, but for now is largely neglected. For example, one could use selective account lockout to block others from time-sensitive transactions such as auction bids, financial transactions, critical e-mails, etc.


Mark Burnett



--------------------------------------------------------------------
Hacking The Code: ASP.NET Web Application Security
http://www.hackingthecode.com