🚀 go-pugleaf

jfh@rpp386.lonestar.org (John F. Haugh II) writes:
>Next, you
>must track and account for all authentication failures and turn off
>any account (either permanently or for a brief period of time) that
>exceeds the allowable number of failed trials.

This means that your system is now open to a "denial of service"
attack.  In other words, although I may not be able to be nasty to you
by logging in on your system and accessing your data, I *can* prevent
you from doing so by making multiple failed login attempts on your
login id.

I'm sure that there are ways of mitigating this risk.  For example,
you might set up your Email system to *always* present *all* address
information as first.last@host.dom.ain, while the actual login id used
is non-predictable.  Some element of "denial of service" risk still
remains, though.

It should be left to the individual site management as to whether this
is a more or less acceptable risk.
-- 
Ron Heiby, heiby@chg.mcd.mot.com	Moderator: comp.newprod
"The centipede has a thousand legs, but he cannot tapdance."