Re: little request :)

> If your site is vulnerable to a 'timed attack' then something else > is wrong? It's a valid point: a site that locks out accounts after just a few failures is not vulnerable to an attack that requires a considerable volume of trials against the same account. However, even though account lockout policies are common on internal networks (where intruders may be physically tracked) not everyone with a public website can be so punitive. You are basically publishing a DoS recipe if your site works this way. In addition, accounts that are whitelisted from being locked out (if any) are usually the most sensitive ones. Yet I acknowledge that some high-profile web apps (LogMeIn comes to mind) do have quick lockout policies. Nevertheless, you should not use rapid account lockouts to combat timing attacks if other measures exist. Security measures should not be so interlocked or accidental. -- Sandy