Rate Limiting and Account Lockout Defenses

Online brute force attacks authenticate against live systems over a network. Each attempt takes at least one round-trip (typically 50-500ms), limiting an attacker to a few thousand attempts per minute at best. This is vastly slower than offline hash cracking. Rate limiting and account lockout exploit this limitation to make online brute force practically impossible within any realistic time frame.

The simplest defence against online brute force is locking an account after a defined number of consecutive failed login attempts, typically 5 to 10. The account can be locked for a fixed duration (15 minutes) or until an administrator manually unlocks it. Lockout turns an online brute force attack from a password cracking exercise into an exhaustion attack against account availability.

Account lockout creates a denial of service vulnerability: an attacker who knows valid usernames can lock out all accounts by sending 5 failed attempts for each. This is a trade-off inherent in lockout policies. Some systems use temporary lockout (5 minutes) rather than permanent lockout to reduce DoS impact. Others do not lock accounts at all but instead use exponential backoff to slow attackers without enabling DoS.

CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) requires solving a visual or audio challenge that is easy for humans but difficult for automated bots. Google reCAPTCHA v3 uses behavioural analysis instead of explicit challenges, assigning a risk score based on mouse movements, timing, and browsing history. CAPTCHA slows automated brute force significantly without locking accounts.

Exponential backoff increases the wait time between allowed login attempts after each failure: 1 second after the first failure, 2 seconds after the second, 4 seconds after the third, and so on. After 10 failures the wait is over 17 minutes. This makes brute force extremely slow without locking the account entirely, avoiding the denial of service risk while still deterring automated attacks.

IP-based rate limiting blocks or challenges login attempts from IP addresses that exceed a threshold of failures per unit time. If an IP submits 50 failed logins in one minute, subsequent attempts from that IP are blocked for an hour. Distributed attacks that use botnets with thousands of different IP addresses can evade simple per-IP limits, requiring more sophisticated velocity detection across multiple signals.

Time-based One-Time Passwords (TOTP, used in Google Authenticator and similar apps) generate a 6-digit code valid for 30 seconds. Even if an attacker brute forces the correct password, they also need the current TOTP code. With only 1 million possible 6-digit codes and a 30-second window, the practical window for TOTP brute force is tiny. MFA effectively eliminates password brute force as a viable attack vector.

bcrypt is a password hashing function with a configurable cost factor. At cost 10, bcrypt takes about 100ms to hash a single password. At cost 12, it takes about 400ms. This means an attacker cracking bcrypt hashes offline can test at most a few hundred passwords per second on a GPU, compared to billions per second for MD5. The work factor can be increased as hardware improves to maintain constant cracking difficulty.

Argon2 won the Password Hashing Competition in 2015 and is the current recommendation for new systems. Its key property is memory hardness: it requires a configurable amount of RAM (typically 64MB to 1GB) to compute. This prevents GPU and ASIC acceleration because these devices have limited memory bandwidth. An attacker with a GPU that can run thousands of parallel bcrypt computations can only run a handful of Argon2 computations due to memory constraints.

Web Application Firewalls can detect credential stuffing by identifying patterns in failed login traffic: high volumes from single IPs, attempts using common username lists, anomalous geographic distribution of login attempts, and time patterns consistent with automated tools. WAF rules can block, challenge, or slow down suspicious traffic before it reaches the application. Modern WAFs integrate threat intelligence feeds for known botnet IP ranges.

Integrating the Have I Been Pwned API into password change flows prevents users from setting passwords that appear in known breach databases. The API uses k-anonymity: only the first 5 hex characters of the SHA-1 hash are sent, protecting user privacy while allowing matching against 850 million known-breached passwords. Blocking breached passwords at registration eliminates a significant fraction of credential stuffing vulnerability.

What is the main security risk created by strict account lockout policies that permanently lock accounts?

Online brute force is limited by network latency; rate limiting and lockout exploit this. Account lockout stops brute force but enables denial of service attacks. Exponential backoff and CAPTCHA mitigate both risks. IP-based rate limiting catches single-source attacks. TOTP MFA effectively defeats password brute force. bcrypt and Argon2 slow offline hash cracking. HIBP API blocks known-breached passwords at registration.