Engineering / ENG-1705
Lock an account's password sign-in for 15 minutes after ten failed passwords in 15 minutes
Description
Acceptance criteria
- Ten failed passwords for an account within 15 minutes lock its password sign-in for 15 minutes.
- The sign-in page tells the person they're locked out for now; the same message whether or not the account exists.
- Single sign-on and phone codes are not affected (phone codes keep their own limit).
- Locks and failures are visible to support in the sign-in log.
Linked issues
- relates to ENG-1731 Lockout tells an attacker which email addresses have accounts Done
Comments (0)
No comments.