Search for: All records

Large-scale online password guessing attacks are widespread and pose a persistant privacy and security threat to users. The common method for mitigating the risk of online cracking is to lock out the user after a fixed number ($$K$$) of consecutive incorrect login attempts. Selecting the value of $$K$$ induces a classic security-usability trade-off. When $$K$$ is too large, a hacker can (quickly) break into a significant fraction of user accounts, but when $$K$$ is too low, we will start to annoy honest users by locking them out after a few mistakes. Motivated by the observation that honest user mistakes typically look quite different from an online attacker's password guesses, we introduce $$\DALock$$, a {\em distribution-aware} password lockout mechanism to reduce user annoyance while minimizing user risk. As the name suggests, $$\DALock$$ is designed to be aware of the frequency and popularity of the password used for login attacks. At the same time, standard throttling mechanisms (e.g., $$K$$-strikes) are oblivious to the password distribution. In particular, $$\DALock$$ maintains an extra ``hit count" in addition to ``strike count" for each user, which is based on (estimates of) the cumulative probability of {\em all} login attempts for that particular account. We empirically evaluate $$\DALock$$ with an extensive battery of simulations using real-world password datasets. In comparison with the traditional $$K$$-strikes mechanism, {our simulations indicate that} $$\DALock$$ offers a superior {simulated} security/usability trade-off. For example, in one of our simulations, we are able to reduce the success rate of an attacker to $$0.05\%$ (compared to $$1\%$$ for the $$3$$-strikes mechanism) whilst simultaneously reducing the unwanted lockout rate for accounts that are not under attack to just $$0.08\%$$ (compared to $$4\%$$ for the $$3$$-strikes mechanism).