(Inspired by a security.stackexchange.com question)
Locking the account after 3 attempts may seem like a good security measure but it may be very perplexing for the user. Having secret questions as a way to unlock the account is a hole in security. Having the admins having to unlock the accounts does not scale well.
If you think about it, the only reason we put the lockout in place is to prevent the brute force password attacks.
Here are the new guidelines from Bill Cheswick of AT&T at OWASP AppSec 2010 conference that are designed to address these issues:
- Don’t count the same invalid password reentered multiple times in a row towards the lockout limit;
- Instead of having users setup secret question which effectively is a (weak) secondary password, have them setup password hint that would remind them what the primary password is;
- Lock the account temporarily, in increasing time increments: e.g. 5, 10, 20, 60 mins
