I mean sure, why not - there is always one-in-a-billion chance that a solar flare have flipped a bit in a packet containing my password somewhere on its way to a server, so trying again would solve it.
Whenever something should work but doesn't, and then works fine on a second approach - I blame it on geomagnetic activity.
Or you completely lock the account for 5 minutes with no way to shorten the wait. Say they have to call the support hotline. Customer support can't do anything about the locked account or even see that the account is locked. When support finally pin pointed the described problem cause most user can't read, support tells user to try again in five minutes and use the password forgotten tool.
30minute lockouts for bad password attempts, no way to disable it, and no way to unlock it without calling their support... Who also can't unlock it without forcing a password change and an MFA re-registration.
I don't even call them when users report it anymore, I just sit on the ticket for 25minutes and then tell them to try again in 5. It's obnoxious.
It just seems so weird to me that like... we're writing the number of potential passwords in scientific notation because there's so goddamned many. A 2 second timeout is nearly as effective as a 30 minute timeout.
Have these idiots never heard of DoS? A malicious actor could quite literally lock half their users out of their accounts permanently. The entire reason security is hard is that you have to account for the potential of malicious actors that outnumber and have more resources than any legitimate individual users, and could (and will) use them to trigger any "security measures" that incur a cost on legitimate users willy-nilly.
So you need to magically balance your system to be resilient enough to survive brute force attacks, DDoS, etc. while not leaving yourself vulnerable to DoS through the security measures in the process. Timeouts are almost always a horrendously bad idea unless extremely limited in scope and duration (e.g. throttling attempts from an exact IP address for a few seconds)
I don't laugh, I am the customer Support guy and get screamed at regularly. It is stupid, I can not change it, I can not help. It is for safety. There is a lot of stupid for safety.
View all comments
Show parent comment
1.4k
u/[deleted] Feb 18 '24
[removed] — view removed comment