Login throttling

[Richard Frovarp]

On 08/04/2016 11:29 AM, Cantor, Scott wrote:
> On 8/4/16, 11:58 AM, "users on behalf of Richard Frovarp" <users-bounces at shibboleth.net on behalf of richard.frovarp at ndsu.edu> wrote:
>
>>     Is there anything built in to IdP v3 that can do login throttling?
> No.
>
>> This would prevent a
>>     remote system from doing a DoS against an account, and prevent searching
>>     for the accounts with a password of "Password1".
> I'd love to see evidence anybody still does this, because I don't believe it. Phishing is too simple.

I don't know if anyone does it large scale. It's the counter argument to 
"just do it at the domain on the account". Obviously we see attacks that 
are probably of the form admin/admin, admin/password, etc on standard 
accounts guessing standard passwords either against SSH or AD. We've 
also seen individual user accounts be hit, and using AD lockout, it ends 
up being a DoS against those accounts. Don't know what the end goal was, 
DoS or online brute force an account. In either case, I would rather 
stop the offender than punish the victim. There is documented evidence 
of attackers triggering the lockout on administrator accounts, trying to 
slow down a response once they've gone overt.

And yes, phishing is way too simple. Up until recently I think they were 
having a competition on how bad they could make it an still get 
credentials. I'm not sure what my Pessward is, but they certainly were 
trying to get it.

>
>> I have mod_security available to use. I could use that if I knew of all
>> of the URLs where a login could be posted.
> That depends on the login flow, but for Password, the URLs are essentially the SSO profile endpoints in the system.
>

Thanks.