RE: Account Lockouts

What i would suggest is that you put an image number on your web
interface. When logging in everyone has to give his useraname , password
and the random image number being displayed currently. The random image
can be made noisy  so that even digital image processing bots fail to read
the image number. 
This would definately prevent the scripts from brute forcing your server.
Thereafter you can apply your constraints like locking out account after X
failures in password.
You must have seen this while registering for a new account at
yahoo/gmail etc.

bye
TARUN BANSAL

On Wed, 1 Dec 2004, David LeBlanc wrote:

> This depends on the asset you're trying to protect. If it is a bank,
> maybe I want to force someone to call.
> 
> This would be hard to implement, but if you could also track the source
> IP of the logon, you could then only allow some small number of user
> names to be tried from any one IP address. Won't protect you from an
> army of bots, but ought to get rid of most of the anklebiters. You may
> run into problems with large proxies if you use this approach, but
> again, this depends on your use scenario.
> 
> Injecting some randomization into the user names would make sense. Make
> the attacker guess as much as possible.
> 
> -----Original Message-----
> From: Harrison Gladden [mailto:[email protected]] 
> Sent: Wednesday, December 01, 2004 9:52 AM
> To: [email protected]; [email protected]
> Subject: Account Lockouts
> 
> Hello all, 
> 
> My question to the group is about handling account lock outs.  Here's
> the situation, assume there is a web interface that lets users log in
> and do stuff, but the log-in process is constrained by the network
> restrictions as well.. Meaning if a user tries to log in X times in Y
> seconds and fails each time, then the account get locked out.
> 
> What are successfull techniques that could be used on the web interface
> to avoid having a script run against it that would potentially lock out
> 15000 user accounts, and create a headache for the system administrators
> who have to manually unlock each account?
> 
> Also assume the current user account names are known by everyone.  
> 
> Possible techniques we've thrown around:
> 1)  Allow each user to pick their own username instead of using a
> standard (i.e. First 3 letters of first name + Full last name)
> 
> 2) Create a set time-out period  for each account of  X (maybe an hour) 
> 
> 
> Hopefully my question makes sense.  
> 
> Thanks,
> Harrison
> --
> ___________________________________
> Harrison Gladden <[email protected]>
> Computer Engineer & Science Major
> ~Past experience: He who never makes 
>    mistakes, never did anything that's worth.~
>

----------------------------------------- (on isc)

________________________________________________________________________

Powered by TREND VirusWall: Information Superhighway Centre, IIT Roorkee


---------------------------------------------------------