Engineering / ENG-1702
Sign-in lockout and rate limits
Description
Shaped in Emargen: Sign-in lockout and rate limits, urgent after OPS-41. Decision in Confluence ENG › ADR-014: Sign-in rate limits at the edge and per account; product page PROD › Sign-in lockout and rate limits.
Why
On the night of 2 September someone tried about 1.9 million leaked email and password pairs against our password sign-in from about 11,000 addresses. Nothing stopped them trying as often as they liked.
What we build
- Per account: ten failed passwords in 15 minutes lock the account's password sign-in for 15 minutes (ENG-1705).
- Per address: limits on the sign-in endpoints at the edge (AWS WAF, OPS-42) and in identity-service.
- Phone codes: five wrong codes and a 15-minute wait, as before; and at most five codes an hour per number.
- The client's administrators get a notice when someone is locked, and can unlock them in the portal.
- Messages never say whether an account exists.
Not in this epic
- A puzzle on the sign-in page: depot kiosks and scanners can't solve one.
- Restricting administrators to known addresses. Checking passwords against leaked lists (ENG-1708).
Done when
Live in every region. Target 10 September.
Child issues
- ENG-1703 identity-service: limit sign-in attempts per address Done
- ENG-1704 Administrators see who is locked, get a notice, and can unlock Done
- ENG-1705 Lock an account's password sign-in for 15 minutes after ten failed passwords in 15 minutes Done
- ENG-1706 Alarms: failed sign-ins and lockouts Done
- ENG-1707 At most five phone codes an hour per number Done
- ENG-1716 Depot PCs behind one address hit the per-address limit at shift change Done
- ENG-1720 Lock message says when the person can try again Done
Linked issues
- relates to OPS-41 Credential stuffing against password sign-in in the EU: about 1.9 million attempts Done
- relates to OPS-42 Edge rate limits on the sign-in endpoints, and managed bad-address lists Done
- relates to SUP-1144 Parcelwise: will ACME lock accounts after failed sign-ins? Done
- relates to OPS-43 Sign-in lockout and rate limits: release in every region, Thursday 07:00 Done
- relates to SUP-1156 Northgate: the exact lockout rule, for our audit file Done
- relates to SUP-1185 Northgate: Preston site manager locked out without typing anything wrong Done
Comments (2)
Mira Holm · 10 Sep 2026, 14:00 UTC
Live in every region since this morning. Closing.
Thresholds agreed with Lena: ten failures, 15 minutes, 15 minutes.