Lock message says when the person can try again

Project: Engineering
Type: Story
Status: Done Done
Priority: Medium
Reporter: Ines Costa <ines.costa@acme-hq.example>
Assignee: Aiko Tanaka <aiko.tanaka@acme-hq.example>
Labels: securitysign-inlockout
Components: identity-serviceportal
Fix versions: identity-service 2026.10.08portal 4.12
Sprint: Sprint 52
Parent: ENG-1702 Sign-in lockout and rate limits
Created: 10 Sep 2026, 08:00 UTC
Updated: 8 Oct 2026, 09:00 UTC
Resolved: 8 Oct 2026, 09:00 UTC

Description

First morning of the lockout (OPS-43): people locked out after ten wrong passwords ring their administrators to ask how long. The message only says the account is locked.

Acceptance criteria

"Too many wrong passwords. Try again at 07:42." in the person's own time zone.
The message is the same whether or not the email has an account (ENG-1731).

Linked issues

relates to ENG-1731 Lockout tells an attacker which email addresses have accounts Done

Comments (1)

Aiko Tanaka · 8 Oct 2026, 09:00 UTC

Out with today's release.