FYI, ---------- Forwarded message ---------- From: Anurag Agarwal <[email protected]> Date: Fri, Aug 20, 2010 at 6:07 AM Subject: [Owasp-leaders] Intellipass - A behavior based password lockout mechanism To: [email protected], owasp-testing < [email protected]>, [email protected], [email protected]
I am pleased to announce Intellipass (a behavior based password lockout mechanism). Most of the password lockout mechanism today are static, which means, they lock a user out after a certain number of incorrect password attempts. This feature is implemented to prevent brute force attempts against the login functionality. Even though this feature does what it’s supposed to, it has its own shortcomings too. >From a security point of view, this feature can be abused by a bad guy to lock most or all of the users by writing a script with all the possible permutations and combinations for a username (which are mostly alphabets, if not alphanumerical), resulting in a denial of service. >From usability point of view, there is always a debate as to the number of attempts to be allowed before locking a user account. Most websites allow 3 attempts while some (very few) allow 5 or sometimes 7. What is the right number for this feature is a subject of debate or at least a different blog post. However, It is a big inconvenience for the user if he is locked out. Till now, there is no other option but to implement a static password lockout mechanism, which has become a de-facto standard for almost every website. Intellipass tries to bridge the gap between the security and the usability aspect of this feature. By storing every login attempt of a user, Intellipass can intelligently understand user’s past behavior and act accordingly. For ex. If a user locks himself out every time, then Intellipass will dynamically increase the number of attempts from 3 to 5 or from 5 to 7. On the other hand, if a user logs in first or second time every time he or she tried to login in the past, but for some reason has taken 3 attempts this time, Intellipass will automatically reduce the number of attempts from 7 to 5 or 5 to 3. The second component of Intellipass is throwing in a random captcha or insert a time delay between the login attempts to prevent automated attacks. Initial release will be in JAVA. We are requesting for everyone to send in their suggestions and ideas as to what can be done to make Intellipass usable by various companies. More details on Intellipass can be found here<https://sites.google.com/site/intellipass/> . http://myappsecurity.blogspot.com/2010/08/intellipass-behavior-based-password.html Thanks, Anurag Agarwal MyAppSecurity Inc Cell - 919-244-0803 Email - [email protected] Website - http://www.myappsecurity.com Blog - http://myappsecurity.blogspot.com LinkedIn - http://www.linkedin.com/in/myappsecurity
_______________________________________________ Owasp-Malaysia mailing list [email protected] https://lists.owasp.org/mailman/listinfo/owasp-malaysia OWASP Malaysia Wiki http://www.owasp.org/index.php/Malaysia OWASP Malaysia Wiki Facebook http://www.facebook.com/pages/OWASP-Malaysia-Local-Chapter/295989208420
