Brute force, lockout, and throttling
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
slow down guessing without handing attackers a new weapon.
Planned topics
- Count failed logins per account and per IP; after a limit (for example 5), delay or block for a time.
- Per-account lockout can be abused to lock real users out: a denial-of-service trade-off.
- Prefer temporary lockouts or growing delays over permanent ones.
- Combine with per-IP limits and, later, extra checks like MFA.
- Answer the same way whether the email exists or not: "invalid email or password".
- Password rules: favor length (for example 12 or more) over complex symbols; check against known breached passwords where possible (concept).
Draft outline details
Demonstration
a state diagram: attempt fails → counter + 1 → at 5, locked for 15 minutes → counter resets after success or timeout.
Check your understanding
What is the risk of locking an account after 5 failures?
Show answer
An attacker can lock out real users on purpose.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.