Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

A web vulnerability scanner on my website made a suggestion that I implement an account lockout mechanism for my site when there has been a certain number of invalid login attempts. I am trying to wrap my head around this to make sure I do it correctly.

This is what I have decided to do. First, in the event of an invalid login attempt the initial error message is that either the username or password was incorrect.

Next, if the username was correct for successive attempts, but the password incorrect, I will begin a counter that will lock the account after x number of tries. I won't display the counter right away, maybe not until there are two tries remaining. This way a user won't get nervous if they simply made a spelling error on their first attempt.

If a user does proceed to lock the account, it can be unlocked by further entering the correct credentials plus answering a security question. If they still do not know the password, they can initiate password recovery through email.

My problem arises when deciding what to do when there have been successive invalid attempts where the username is incorrect. Since the username is incorrect, there is no account to lock. I have read suggestions to lock the login script internally and introduce a throttle to slow down any would be crackers, but just continue to display the standard error message that the username or password is incorrect. The only problem I have with this suggestion is that once somebody figures out how the lockout works they can gain a clue as to whether they are inputting a valid username or not, by seeing a counter after successive failures they will know they have a valid username, no counter = not a valid username.

Anybody have thoughts on this they can share?

EDIT I agree that some legitimate users could get caught in this lock out process. I think that my use of the phrase "would be crackers" takes into account that not everybody who forgets their username/password is indeed a cracker.

share|improve this question
2  
Why do you assume that anyone doing multiple login attempts is a cracker? Plenty of people cannot remember what username they registered with and using an ambiguous "username or password is wrong" message does little to help these people. Many cannot even remember what email address they signed up with for account recovery purposes. Related reading: blog.mailchimp.com/social-login-buttons-arent-worth-it –  cimmanon Oct 9 '13 at 17:17
    
The assumption that I am making for my site, and it could be wrong, is that I will not get casual users who may sign up and then forget they did. The particular people that I am targeting, lawyers with a little bit of tech knowledge, should be able to remember their username and password. I suppose data will prove this assumption correct or not, but my bias to begin with is if I see a bunch of invalid logins on this site something may be up. Again, I could be wrong. I guess if you take the position that it is not a big deal to tell whether a username is correct, my issue kind've dissappears. –  Cbomb Oct 9 '13 at 18:15
1  
I'm a developer myself and even I can't remember the username/password/email combination I use for every site. I have 2 usernames, 6 passwords, and 3 email addresses that I commonly use for account purposes. Even if I guess the right combination on the first try, there are other factors that may cause authentication errors (caps key on, fat fingers, etc.). –  cimmanon Oct 9 '13 at 18:23
    
I use a password manager myself. When I saw a list of all my passwords, about 50 in all, I was flabbergasted as to how many there were. –  Cbomb Oct 9 '13 at 18:30
add comment

1 Answer

IMO,

"to lock the login script internally and introduce a throttle to slow down" is far more mature approach to handle erroneous login attempt.

As far as i know Windows as well as Linux use this approach. Don't know about Mac, though.

You can make that a little more interactive by adding that after 2/3 wrong attempt, the "Forgot Password" button shows up.

share|improve this answer
1  
I agree with the slower and slower response for failed attempts from the same client (IP), but that can lead to issues for people sharing a proxy. Introducing Captcha after a few failures could alleviate that. –  Bernhard Hofmann Oct 10 '13 at 9:25
    
@BernhardHofmann i agree with you that using captcha can alleviate that. But, it is justified depending on the diversity of the website itself. –  kmonsoor Oct 10 '13 at 10:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.