Northgate: the exact lockout rule, for our audit file

Hi Rachel, as of this morning:

• Passwords: ten failed passwords within 15 minutes lock that account's password sign-in for 15 minutes. The person is told on the sign-in page; your administrators get a notice in the portal and can unlock them sooner.
• Phone codes: five wrong tries on a code, then a 15-minute wait; at most five codes an hour per number. That limit isn't new; it has been there since phone codes started.
• Per address: attempts from one internet address are limited at the edge.
• Messages never say whether an account exists.
• Lockouts show in the sign-in log, which administrators can read.

Perfect, filed.