🚀 go-pugleaf

In article <1992Aug10.191851.4562@chg.mcd.mot.com> heiby@chg.mcd.mot.com (Ron Heiby) writes:
>jfh@rpp386.lonestar.org (John F. Haugh II) writes:
>>Next, you
>>must track and account for all authentication failures and turn off
>>any account (either permanently or for a brief period of time) that
>>exceeds the allowable number of failed trials.
>
>This means that your system is now open to a "denial of service"
>attack.  In other words, although I may not be able to be nasty to you
>by logging in on your system and accessing your data, I *can* prevent
>you from doing so by making multiple failed login attempts on your
>login id.

That's correct.  I think that any scheme which merely relies on failed
authentication counters to protect the system is going to suffer from
this deficiency.  If the only thing you have is a hammer, everything
looks like a nail ...

The approach that I prefer is one where the number of trials before
an account is locked out is large enough that the attack must last for
an extended period of time and STILL not have a reasonable probability
of success.  This differs from many systems where 3 or 5 failed trials
disables the account yet still protects you against someone who is
somewhat determined.

>I'm sure that there are ways of mitigating this risk.  For example,
>you might set up your Email system to *always* present *all* address
>information as first.last@host.dom.ain, while the actual login id used
>is non-predictable.  Some element of "denial of service" risk still
>remains, though.

The problem then is that the bad guy might get the login name of the
user that is under attack.  Using card keys which present a random ID
(really random, not predictably random) would solve this problem, but
then you could just get rid of the password and use that random value
as authentication for the user.  [ Supposing that you want to give
access only to the person who physically possesses the card ... ]
-- 
John F. Haugh II                   | Life's Little Instruction Book:
Ma Bell: (512) 251-2151            | "#138.  Learn Spanish.  In a few years,
UUCP: ...!cs.utexas.edu!rpp386!jfh |  more than 35% of all Americans will speak
Domain: jfh@rpp386.cactus.org      |  it as their first language."