Sign-in lockout and rate limits

Owner: Mira Holm · Epic: ENG-1702 · Shipped: Thursday 10 September · Shaped in Emargen as "Sign-in lockout and rate limits", urgent after OPS-41

Why

On the night of 2 September someone tried leaked passwords against our password sign-in from thousands of addresses (OPS-41). Nothing stopped them trying as often as they liked.

What we built

• Per account: ten failed passwords in 15 minutes lock the account for 15 minutes (ENG-1705).
• Per address: limits on the sign-in endpoints at the edge, in the web application firewall (OPS-42), and in identity-service.
• Phone codes: five wrong codes and a 15-minute wait, as before; and at most five codes an hour per number.
• The customer's administrators get an in-app notice when someone is locked out, and can unlock them in the portal.
• Messages never say whether an account exists.
• Sign-ins through Entra ID or Okta are left to the customer's identity provider.

What we left out

• A puzzle on the sign-in page: depot kiosks and scanners can't solve one.
• Restricting administrators to known IP addresses. Halden asked later; not built.
• Checking passwords against lists of leaked ones.

Rollout

On for everyone on 10 September. In the first week, 37 accounts were locked; all but two were people who had forgotten their password. The thresholds were not changed.