I've been reading some literature on security, specifically password security/encryption, and there's been one thing that I've been wondering: is the 3-strike rule a perfect solution to password security? That is, if the number of password attempts is limited to some small number, after which all authentication requests will not be honored, will that not protect users from intrusion? I realize gaining access or control over something doesn't always mean going through the authentication system, but doesn't this feature make dictionary/brute-force attacks obsolete? Is there something I'm missing?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
Yes, it will make dictionary attacks impossible through the login mechanism. (That doesn't mean much if they obtain access to the database, though. For security there you'll need to properly hash and salt the passwords.)
It also allows the possibility of a DOS attack against a certain user. Let's say I wanted to prevent you from logging in. All I'd have to do is run three bogus login attempts against your account, and then do it again every time you do whatever's necessary to reset the login. Dealing with that issue is a bit trickier.
I also agree that it makes dictionary attacks less effective as ways to gain access to an account without the proper authority. However:
Anyway, I hope one or some combination of these approaches will come in handy.