Re: Account Lockout Settings

[Roger Safian <r-safian () NORTHWESTERN EDU>]

At 02:25 PM 4/27/2010, Rivers, Andrew E put fingers to keyboard and wrote:
> As our users change their password, it never fails that at least one of these many devices will continue to 
> authenticate with the old password and, as you guessed, lock out their account.

Our group advocates the use of lockouts that expire after some point
of time.  Lockouts that don't expire can just be used as a denial
of service attack.



--
Roger A. Safian
r-safian () northwestern edu (email) public key available on many key servers.
(847) 467-6437   (voice)
(847) 467-6500   (Fax) "You're never too old to have a great childhood!"