Questions tagged [account-lockout]
The account-lockout tag has no summary.
37 questions
0 votes
0 answers
96 views
Should I let administrator account bypass IP ACL?
Let's say there is a system that can set IP ACL for security. If administrator can't bypass IP ACL, account may by locked up when machine or network IP changed But if administrator can bypass IP ACL, ...
- 101
0 votes
2 answers
494 views
Revoke all refresh tokens when account locked?
Scenario: a user enters his password incorrectly x times, so his account is locked for y minutes. Should I revoke all his refresh tokens? Problems: user is logged out of all devices, not just the one ...
- 485
6 votes
3 answers
10k views
Friend's Instagram account repeatedly hacked despite changing all information and enabling 2FA
My friends Instagram account has repeatedly been hacked. Someone is gaining access to her account, proceeding to change all the security information to lock her out. Then posts scam ads on her account....
- 61
0 votes
1 answer
164 views
New gateway results in Google and Amazon security lockout, "device not recognized"
The cable company recently replaced my old gateway/wireless router. After the new gateway was installed (a "Touchstone TG1682G Telephony Gateway", if it matters), both Google and Amazon required ...
- 581
2 votes
1 answer
368 views
Is it ok to let someone unlock their own account with their admin account?
Scenario: Person A's normal computer account is personA. They have locked this out with too many bad password attempts. The user is part of the IT group, so they also have an admin account: personA-...
- 21
0 votes
2 answers
374 views
What are the security practice or case studies for account lockouts?
We have a platform where users can sign up for free using their email addresses (they can also associate social media account). Other than the name, email and social account there no other personal ...
- 101
0 votes
3 answers
1k views
Can a password change via CSRF lead to account takeover?
If a website has a password change functionality where the user isn't prompted for the current password and the form isn't using tokens to mitigate CSRF attacks, an attacker can easily execute a CSRF ...
- 1,448
1 vote
0 answers
162 views
Authentication: E-mailing security codes vs clickable links
I've noticed a trend in how big companies (Amazon, Skype, and a few others I don't remember in particular) handle e-mail authentication. Rather than e-mailing clickable links with some single-use ...
- 168
2 votes
1 answer
979 views
Facebook security algorithm: Locked out of my own account after resetting password
I created a secondary Facebook account months ago from Argentina. Now I logged back in, and noticed countless logins from RUSSIA and the account is clearly being used by some Russian dude. I logged ...
- 121
3 votes
2 answers
2k views
Account lockout to protect from brute force: doesn't it open up vulnerabilities to DOS attacks? [duplicate]
AFAIK the recommended practice to mitigate brute force attacks is to lock an account down for, say, 15 min (perhaps escalating lockout time if the attack continues afterwards?) after, say, 5 failed ...
- 6,851
9 votes
2 answers
472 views
Are FIDO U2F keys (like dual Yubikeys or dual Google Titan keys) undermined by the Google account recovery process?
According to the Google information page here: https://support.google.com/accounts/answer/6103523 If you don’t have another second step or forgot your password Note: 2-Step Verification requires an ...
- 220
0 votes
1 answer
199 views
Is any plaintext stored as a password hash an effective way to lock out an account?
I'm building a web app with Flask and I have user accounts that store their passwords in a MySQL String column using werkzeug.security's generate_password_hash() method. I wanted to create a Community ...
- 297
2 votes
2 answers
1k views
In which cases you should block a user after a certain number of failed attempts?
I have a web app. Existing users can invite new users by sending a mail throw the web app. If the user fails 4 consecutive times I block the acount for 5 minutes. Currently there is no important ...
- 123
0 votes
1 answer
406 views
Recovering locked-out accounts after losing smartphone
Ok so, we've got a situation here that sounds a bit hopeless, but it's happening right now and we could really use some help. Please bear with me here as I try to explain... Recently, my wife and I ...
- 29
0 votes
0 answers
129 views
Policy for regaining access to a colleague's account
I run a SaaS used by teams to collect company-related information (think something like Crashlytics). Even if the tool lets users invite their colleagues, we often find cases of individuals who ...
- 283