Fedora's invisible passwords and visible squabbles [LWN.net]

Fedora's invisible passwords and visible squabbles

Posted May 9, 2013 15:18 UTC (Thu) by apoelstra (subscriber, #75205)
In reply to: Fedora's invisible passwords and visible squabbles by Funcan
Parent article: Fedora's invisible passwords and visible squabbles

> If you allow complex passwords and have reasonably well educated users, then locking after 10 or 20 wrong attempts, rather than 3, might start to make sense. Locking for a sort time rather than indefinitely might start to make sense too. Fail2ban short term IP blocks might also make sense too

If you had said 100 or 200 attempts, I'd agree with you. No human is going to accidentally mess up a password that many times, any bad guy who can guess the password in fewer tries knows too much anyway (you already have compromised security), and brute forcing is completely blocked.

Alternately, blocking unilaterally for 15 or 30 seconds after every bad attempt would also prevent brute-forcing, as well as be extremely irritating to human bad guys.

Fedora's invisible passwords and visible squabbles

Posted May 15, 2013 14:14 UTC (Wed) by hummassa (guest, #307) [Link] (1 responses)

Apple does the right thing with respect to this: throttle exponentially against the number of tries. 10s, 30s, 1.5min, 4.5min, 13.5min, 40.5min and so on.

Fedora's invisible passwords and visible squabbles

Posted May 16, 2013 13:21 UTC (Thu) by callegar (guest, #16148) [Link]

No, not at all. It is quite irritating when you leave your ipad around to see that someone had fun in locking it for almost 15'.

Really, this does not make any sense. To avoid brute force attacks a few seconds are more than enough: 100000 trials * 36 sec = 3600000 sec = 3600h = half a year > average time between recommended password changes.