full-disclosure - Re: Secure OWA

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <70f230c70608301140o26a0afbduee298479ac5f19ed@mail.gmail.com>
Date: Wed, 30 Aug 2006 12:40:41 -0600
From: "Mark Senior" <senatorfrog@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Secure OWA

On 8/30/06, Renshaw, Rick (C.) wrote:
>
> >
> There's two sides to this risk.  If you allow OWA logins to lock out
> accounts, and your OWA page is available from anywhere on the Internet, you
> are handing an easy DOS tool to anyone that knows the account names for
> people on your server.

I think a possibly better approach, although it doesn't seem like you
could implement it quite as simply as account lockouts, would be to
lock out, not the account, but the originating IP address, for a
duration.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/