Fedora's invisible passwords and visible squabbles [LWN.net]

Fedora's invisible passwords and visible squabbles

Posted May 9, 2013 16:09 UTC (Thu) by andresfreund (subscriber, #69562)
In reply to: Fedora's invisible passwords and visible squabbles by mitr
Parent article: Fedora's invisible passwords and visible squabbles

> I think it's exactly the other way around: systems should lock users out, at least for some time, on incorrect attempts; if they do, the passwords can be much shorter and easier to enter.

> This is especially applicable to web applications, where every log in attempt is "online" and the lockout policy can be consistently enforced.

Making it extremely easy to lock somebody out of their account. Pissed about somebody? Enter 10 times the wrong password on their email account's web interface. In contrast to protecting my account with a good password I can't do anything to protect my account to being temporarily blocked in this case.

to post comments

Fedora's invisible passwords and visible squabbles

Posted May 9, 2013 17:32 UTC (Thu) by mitr (subscriber, #31599) [Link] (1 responses)

Teaching the lockout logic about existence of IP addresses (which more or less can't be forged with TCP), to be smart about treating attacks from a single IP address / small IP block / botnets different, and to alert human administrators about unusal cases should not be that hard.

It would be nice if every application didn't have to invent this from scratch, sure - are there any libraries that can already do this?

Fedora's invisible passwords and visible squabbles

Posted May 10, 2013 10:18 UTC (Fri) by k8to (guest, #15413) [Link]

Well when the implementation involves logfile scraping (common) then you sure can forge IP addresses.

just log in as the username "jrodman]: 1.2.3.4" or similar.