How do I best tell a user that his/her account will be locked if they enter the wrong credentials too many times?

Question

We are going to add an additional layer of security to our product by locking user accounts for a short period of time (configurable in the product, but probably 5-10 minutes) when a user has tried to log in unsuccessfully a number of times (also configurable, but the default setting will probably be around 5 times).

I am now trying to figure out how best to present this to the user.

Option A: Count down the number of attempts left every time the users makes an unsuccessful attempt to log in. E.g. "You have 3 login attempts left", "You have 2 login attempts left" etc. The problem with this approach, as I see it, is that it adds an unnecessary and possibly stressful component to the login process. On the other hand people will probably be less sloppy when entering their passwords if they are informed immediately after the first error that they only have so many attempts before the account is locked.

Option B: Only present a warning before the final attempt. E.g. "For security reasons your user account will be locked for X minutes if you enter the wrong credentials again." This approach avoids unnecessary information until the user actually needs it and I am leaning towards this option.

What are your thoughts? Is there another, better way?

Answer 1

TL;DR - Most of the time I've seen people add this feature it's been pure security theatre. It hasn't helped the user and doesn't make the site safer. Avoid if possible.

The long version...

Personally - I'd start questioning whether this was actually a good feature to add. Is it actually making the system more secure? Are there better ways to make it secure?

Here I'm assuming that it's a web based application. I'm assuming the login is pure username/email & password. Some of this doesn't apply if those two assumptions are incorrect.

• Are people actually trying to crack the system? Is this addressing a real problem - or one that people think is going to happen / happening? If the latter then I would fight very hard for there to be evidence that this was a problem before adding the feature. Once place I worked with was sure they were getting hacking attacks because of large numbers of failed password attempts. On investigation it turns out they just had a lot of users forgetting their passwords... A different client found out it was a spamming bot that was posting e-mail addresses and URLs to the login boxes. Be sure first. User lock outs add little security, add risk (see below), and makes the users job more stressful.

• If you add an account lockout you have immediately made the site open to a denial of service attack. Remember most serious cracking attacks are mass attacks targeted at the site in general, not targeted attacks at individuals. They'll be trying thousands/millions of username/password combinations. Suddenly you have thousands of users locked out of their accounts. This causes a roll-on effect that overloads your support centre with calls/emails. This causes your support to fall over. This causes people to bitch and moan about how lousy the service is. Welcome to PR hell. I've seen this happen twice now :-)

• Lock outs don't help in most instances. Since cracking attempts are mostly mass attacks the crackers won't care. They'll just move on to the next account and come back N minutes later and carry on.

If it is happening there are much better techniques to solve it than a simple failed-login-attempt counter being exceeded. For example a combination of all of the following:

• On the Nth attempt start introducing an additional authentication technique. A birthday, a CAPTCHA (one of the few times I think they're a reasonable option :-), answer to a security question, etc. By adding a third piece of information you make it harder to for crack attacks.

• Start directing users towards the password reset mechanism so they have an automated mechanism to recover the password they have obviously forgotten.

• Rather than lock people out start introducing pauses into the login process. Make the initial pauses short, make the pauses after multiple attempts longer. Throttling dramatically cuts down the risk since it forces the cracker bots to drop down the number of attempts to a human-scale, and that's not enough to get in guessing passwords at random.

Answer 2

Standard security practice is not to divulge anything about the process while it's in progress. This is because it aids unauthorised attempts to access the system.

This may not be a particularly necessary consideration for a message like "You have two attempts left," but never tell the user how long the account will be locked out for. It gives away too much information about your security model.

Similarly, never give a hint about which token is wrong: whether the username is not recognised or the password isn't correct. A message saying the username is wrong tells a cracker* not to use it again; a message that the password is wrong tells him that the username is valid and he only needs to try passwords. Always give a generic "Invalid login" message.

None of this precludes offering help on recovering a lost password.

Instead of giving hints during the process, these things need to be communicated to new users during their induction training, and (if it's a new security regime introduced for existing users) either directly to users in a mailshot or as a system message once they're logged in.

---

*Yes, cracker, not hacker. Eric S Raymond on the difference

Answer 3

I'd say option B seems the most logical solution for me; as you said, Option A just adds a stressful component to the login process and telling me how many attempts I have left, will not at all make me remember my password faster.

I do have a suggestion for Option B though:

I don't know if I should mind the copy, but if so, I'd make it a lot shorter and to the point. And why not guide the user to a solution if possible? So don't just tell that there's one attempt remaining, also help that user retrieve their password if they have really lost it.

For example:

"For security reasons, you have 1 attempt remaining. Forgot your password?"

Answer 4

Option C:

Let them make one error without anything happening. (which covers for the 'I know I made a typing error' situation)

Then on the second error show the Option A countdown sequence.