Re:Prevent users registering with passwords from data breaches
by air7 on Saturday January 19, 2019 @07:43AM
(#18946739)
> Aside, how do you implement account-locking without making it trivial for users to DoS each other that way?
By adding an (increasing) time delay after each failed attempt. However many sites, banking in particular, just lock your account and you have to call them on the phone to reopen it. Totally open for massive DoS but the world still stands.
Re:Prevent users registering with passwords from data breaches
by hombre_fatal on Saturday January 19, 2019 @08:51AM
(#18947028)
Well, that introduces trivial DoS, so it doesn't satisfy my question.
Notice that banking websites can get away with it, yet surely you weren't only talking about banking when you said "online attacks".
Re:Prevent users registering with passwords from data breaches
by air7 on Saturday January 19, 2019 @11:30AM
(#18947753)
Sorry, I tried to say 2 things:
1. Your simple solution: add a 5 second delay after each failed attempt per username OR ip address.
2. It seems that sites that do account lock-outs don't suffer from DOS attacks, for some reason.
Before that, attackers would just wait for new usernames to appear on the scoreboard/chat and check them against password dumps. The easy come, easy go nature of bitcoin made it particularly lucrative.
Password reuse is a massive issue. At a glance, one might wonder why most sites need to care so much since they don't deal with money. Who cares about a forum like HN? But consider that it's easier to audit/impede new accounts with anti-spam measures, so there's value in taking over old accounts. And you don't want people with moderation tools getting attacked either. Ideally, it's nice to be able to trust an account with 1,000 posts more than one with 0 posts, but that evaporates when accounts are easily stolen.
Aside, how do you implement account-locking without making it trivial for users to DoS each other that way?