🚀 go-pugleaf

dave@lacerta.unm.edu (Dave Grisham) wrote:
>Does any site lock accounts that their password guesser guesses? --grish

If my guesser successfully breaks a user login, I send email to that user,
telling them to change their password; I also give a bit of guidance for
"good password selection".  

This continues until they pick a password that my guesser doesn't break.

If the user ignores several email messages AND doesn't change the password,
I lock the account; on login, they see a message that says (essentially) 
"to get your account back, come see XXXX in room XXXX".

[If the user goes one week without logging in after I've sent email, I
 feel that I must lock the account anyway.  I realize that many users
 do not check their email every day, but I feel that a week is adequate
 time to do so.]

As far as our policy goes, locking the account (ONLY after repeated 
requests to change the password) falls under "failure to follow the
directions of University staff acting in the performance of their 
duties."

--Wes

-- 
MORGAN@UKCC         |       Wes Morgan       |        ...!ukma!ukecc!morgan 
morgan@ms.uky.edu   | Engineering  Computing |   morgan@wuarchive.wustl.edu
morgan@engr.uky.edu | University of Kentucky | JWMorgan@dockmaster.ncsc.mil
  Mailing list for AT&T StarServer S/E  - starserver-request@engr.uky.edu