Put a hard limit on password login attempts from the same remote address


Put a hard limit on password login attempts from the same remote address

Ref T13222. Currently, if a remote address fails a few login attempts (5) in a short period of time (15 minutes) we require a CAPTCHA for each additional attempt.

This relies on:

  • Administrators configuring ReCAPTCHA, which they may just not bother with.
  • Administrators being comfortable with Google running arbitrary trusted Javascript, which they may not be comfortable with.
  • ReCAPTCHA actually being effective, which seems likely true for unsophisticated attackers but perhaps less true for more sophisticated attackers (see https://github.com/ecthros/uncaptcha2, for example).

(For unsophisticated attackers and researchers, "Rumola" has been the standard CAPTCHA bypass tool for some time. This is an extension that pays humans to solve CAPTCHAs for you. This is not practical at "brute force a strong password" scale. Google appears to have removed it from the Chrome store. The "submit the captcha back to Google's APIs" trick probably isn't practical at brute-force-scale either, but it's easier to imagine weaponizing that than weaponizing human solvers.)

Add a hard gate behind the CAPTHCA wall so that we fail into a secure state if there's no CAPTCHA or the attacker can defeat CAPTCHAs at a very low cost.

The big downside to this is that an attacker who controls your remote address (e.g., is behind the same NAT device you're behind on corpnet) can lock you out of your account. However:

  • That should be a lot of access (although maybe this isn't that high of a barrier in many cases, since compromising a "smart fridge" or "smart water glass" or whatever might be good enough).
  • You can still do "Forgot password?" and login via email link, although this may not be obvious.

Test Plan:

  • Logged in normally.
  • Failed many many login attempts, got hard gated.

Reviewers: amckinley

Reviewed By: amckinley

Maniphest Tasks: T13222

Differential Revision: https://secure.phabricator.com/D19997


epriestleyAuthored on Jan 18 2019, 1:50 PM
epriestleyPushed on Jan 19 2019, 3:48 AM
Differential Revision
D19997: Put a hard limit on password login attempts from the same remote address
rPc125ab7a42bf: Remove "metamta.*.subject-prefix" options
T13222: 2018 Week 48-51 Bonus Content
Build Status
Buildable 21597
Build 29445: Run Core Tests