Re:New NIST password guidelines: don't require character typ...
by mulmen on Wednesday December 14, 2016 @12:39AM
(#13174113)
> Unless otherwise specified in the description of a given authenticator, the verifier SHALL effectively limit online attackers to 100 consecutive failed attempts on a single
The latter still limits an attacker but is less likely to be a plausible DoS against the account unless the attacker has compromised the legitimate user's machine at which point all is lost anyway. Later in the same section:
> When the subscriber successfully authenticates, the verifier SHOULD disregard any previous failed attempts from the same IP address.
Which suggests the failure count is per IP and not per account.
I think that can be read two ways.
1) 100 failed attempts/account/month 2) 100 failed attempts/IP/account/month
The latter still limits an attacker but is less likely to be a plausible DoS against the account unless the attacker has compromised the legitimate user's machine at which point all is lost anyway. Later in the same section:
> When the subscriber successfully authenticates, the verifier SHOULD disregard any previous failed attempts from the same IP address.
Which suggests the failure count is per IP and not per account.