ruhr-universitÄt bochum will any password do? …€¦ · rate-limiting on the web way’18,...
TRANSCRIPT
![Page 1: RUHR-UNIVERSITÄT BOCHUM WILL ANY PASSWORD DO? …€¦ · RATE-LIMITING ON THE WEB WAY’18, Baltimore, MD, USA, 12 August 2018 Maximilian Golla, Theodor Schnitzler, Markus Dürmuth](https://reader036.vdocuments.mx/reader036/viewer/2022071019/5fd327b72e1dda249b75aaf2/html5/thumbnails/1.jpg)
WILL ANY PASSWORD DO? EXPLORING RATE-LIMITING ON THE WEBWAY’18, Baltimore, MD, USA, 12 August 2018
Maximilian Golla, Theodor Schnitzler, Markus Dürmuth
RUHR-UNIVERSITÄT BOCHUM
![Page 2: RUHR-UNIVERSITÄT BOCHUM WILL ANY PASSWORD DO? …€¦ · RATE-LIMITING ON THE WEB WAY’18, Baltimore, MD, USA, 12 August 2018 Maximilian Golla, Theodor Schnitzler, Markus Dürmuth](https://reader036.vdocuments.mx/reader036/viewer/2022071019/5fd327b72e1dda249b75aaf2/html5/thumbnails/2.jpg)
2
MOTIVATION
at least 8 characters
WILL ANY PASSWORD DO? RATE-LIMITING ON THE WEB
WAY’18, Baltimore, MD, USA, 12 August 2018
Maximilian Golla, Theodor Schnitzler, Markus Dürmuth
upper case, lower case, numbers,
special characters
change once a month
do not reuse
not more than 8 characters
Rate-limiting
“… the verifier shall limit attempts on a single
account to no more than 100.”
(NIST Special Publication 800-63B)
Research Question
Do real-world websites take appropriate measures
to prevent unauthorized accesses to their users’
accounts?
![Page 3: RUHR-UNIVERSITÄT BOCHUM WILL ANY PASSWORD DO? …€¦ · RATE-LIMITING ON THE WEB WAY’18, Baltimore, MD, USA, 12 August 2018 Maximilian Golla, Theodor Schnitzler, Markus Dürmuth](https://reader036.vdocuments.mx/reader036/viewer/2022071019/5fd327b72e1dda249b75aaf2/html5/thumbnails/3.jpg)
3
STUDY PROCEDURE
WILL ANY PASSWORD DO? RATE-LIMITING ON THE WEB
WAY’18, Baltimore, MD, USA, 12 August 2018
Maximilian Golla, Theodor Schnitzler, Markus Dürmuth
Final valid attempt
Correct credentials
From same Tor session
Tor network
Hide identity
Circumvent IP blocking
Number of attempts
Usability: min. 10
NIST: max. 100
First impression
No resource wasting
![Page 4: RUHR-UNIVERSITÄT BOCHUM WILL ANY PASSWORD DO? …€¦ · RATE-LIMITING ON THE WEB WAY’18, Baltimore, MD, USA, 12 August 2018 Maximilian Golla, Theodor Schnitzler, Markus Dürmuth](https://reader036.vdocuments.mx/reader036/viewer/2022071019/5fd327b72e1dda249b75aaf2/html5/thumbnails/4.jpg)
4
WEBSITES
Existing Accounts
History & Value
Don’t be evil
Our own accounts
WILL ANY PASSWORD DO? RATE-LIMITING ON THE WEB
WAY’18, Baltimore, MD, USA, 12 August 2018
Maximilian Golla, Theodor Schnitzler, Markus Dürmuth
![Page 5: RUHR-UNIVERSITÄT BOCHUM WILL ANY PASSWORD DO? …€¦ · RATE-LIMITING ON THE WEB WAY’18, Baltimore, MD, USA, 12 August 2018 Maximilian Golla, Theodor Schnitzler, Markus Dürmuth](https://reader036.vdocuments.mx/reader036/viewer/2022071019/5fd327b72e1dda249b75aaf2/html5/thumbnails/5.jpg)
5
PASSWORDS
WILL ANY PASSWORD DO? RATE-LIMITING ON THE WEB
WAY’18, Baltimore, MD, USA, 12 August 2018
Maximilian Golla, Theodor Schnitzler, Markus Dürmuth
Manual Verification
“8 or more characters”
“12345678” not allowed
Composition Policies
Remove non-compliant
passwords
Bad practice still in use
Baseline
Pwned Passwords v2
500 million breached
passwords
![Page 6: RUHR-UNIVERSITÄT BOCHUM WILL ANY PASSWORD DO? …€¦ · RATE-LIMITING ON THE WEB WAY’18, Baltimore, MD, USA, 12 August 2018 Maximilian Golla, Theodor Schnitzler, Markus Dürmuth](https://reader036.vdocuments.mx/reader036/viewer/2022071019/5fd327b72e1dda249b75aaf2/html5/thumbnails/6.jpg)
6
RESULTS OVERVIEW
WILL ANY PASSWORD DO? RATE-LIMITING ON THE WEB
WAY’18, Baltimore, MD, USA, 12 August 2018
Maximilian Golla, Theodor Schnitzler, Markus Dürmuth
Alexa Service GuessesTime
(Min.)Login CAPTCHA Lockout Blocking 2nd Step Notification
1 Google 25 10 o • o • - -
3 Facebook 25 4 o o • o - -
7 Yahoo 25 5 o • o • Email Code Suspicious
12 Twitter 25 4 • o o • Phone No. Sign-in, Suspicious
30 Netflix 25 7 o o • • - -
84 Amazon 25 15 • • o • Email Code -
89 Dropbox 25 19 • • o o - Sign-in
285 IKEA 7 2 o o • o - Account Locked
664 Grammarly 13 6 o o • • - -
992 Plex 25 7 • o o • - -
1220 Uber 25 9 • • o • SMS Code -
4333 Trainline 25 3 • o o o - -
![Page 7: RUHR-UNIVERSITÄT BOCHUM WILL ANY PASSWORD DO? …€¦ · RATE-LIMITING ON THE WEB WAY’18, Baltimore, MD, USA, 12 August 2018 Maximilian Golla, Theodor Schnitzler, Markus Dürmuth](https://reader036.vdocuments.mx/reader036/viewer/2022071019/5fd327b72e1dda249b75aaf2/html5/thumbnails/7.jpg)
7
RESULTS OVERVIEW
WILL ANY PASSWORD DO? RATE-LIMITING ON THE WEB
WAY’18, Baltimore, MD, USA, 12 August 2018
Maximilian Golla, Theodor Schnitzler, Markus Dürmuth
Alexa Service GuessesTime
(Min.)Login CAPTCHA Lockout Blocking 2nd Step Notification
1 Google 25 10 o • o • - -
3 Facebook 25 4 o o • o - -
7 Yahoo 25 5 o • o • Email Code Suspicious
12 Twitter 25 4 • o o • Phone No. Sign-in, Suspicious
30 Netflix 25 7 o o • • - -
84 Amazon 25 15 • • o • Email Code -
89 Dropbox 25 19 • • o o - Sign-in
285 IKEA 7 2 o o • o - Account Locked
664 Grammarly 13 6 o o • • - -
992 Plex 25 7 • o o • - -
1220 Uber 25 9 • • o • SMS Code -
4333 Trainline 25 3 • o o o - -
![Page 8: RUHR-UNIVERSITÄT BOCHUM WILL ANY PASSWORD DO? …€¦ · RATE-LIMITING ON THE WEB WAY’18, Baltimore, MD, USA, 12 August 2018 Maximilian Golla, Theodor Schnitzler, Markus Dürmuth](https://reader036.vdocuments.mx/reader036/viewer/2022071019/5fd327b72e1dda249b75aaf2/html5/thumbnails/8.jpg)
8
RESULTS OVERVIEW
WILL ANY PASSWORD DO? RATE-LIMITING ON THE WEB
WAY’18, Baltimore, MD, USA, 12 August 2018
Maximilian Golla, Theodor Schnitzler, Markus Dürmuth
Alexa Service GuessesTime
(Min.)Login CAPTCHA Lockout Blocking 2nd Step Notification
1 Google 25 10 o • o • - -
3 Facebook 25 4 o o • o - -
7 Yahoo 25 5 o • o • Email Code Suspicious
12 Twitter 25 4 • o o • Phone No. Sign-in, Suspicious
30 Netflix 25 7 o o • • - -
84 Amazon 25 15 • • o • Email Code -
89 Dropbox 25 19 • • o o - Sign-in
285 IKEA 7 2 o o • o - Account Locked
664 Grammarly 13 6 o o • • - -
992 Plex 25 7 • o o • - -
1220 Uber 25 9 • • o • SMS Code -
4333 Trainline 25 3 • o o o - -
![Page 9: RUHR-UNIVERSITÄT BOCHUM WILL ANY PASSWORD DO? …€¦ · RATE-LIMITING ON THE WEB WAY’18, Baltimore, MD, USA, 12 August 2018 Maximilian Golla, Theodor Schnitzler, Markus Dürmuth](https://reader036.vdocuments.mx/reader036/viewer/2022071019/5fd327b72e1dda249b75aaf2/html5/thumbnails/9.jpg)
9
ACCOUNT LOCKOUT
WILL ANY PASSWORD DO? RATE-LIMITING ON THE WEB
WAY’18, Baltimore, MD, USA, 12 August 2018
Maximilian Golla, Theodor Schnitzler, Markus Dürmuth
Alexa Service GuessesTime
(Min.)Login CAPTCHA Lockout Blocking 2nd Step Notification
1 Google 25 10 o • o • - -
3 Facebook 25 4 o o • o - -
7 Yahoo 25 5 o • o • Email Code Suspicious
12 Twitter 25 4 • o o • Phone No. Sign-in, Suspicious
30 Netflix 25 7 o o • • - -
84 Amazon 25 15 • • o • Email Code -
89 Dropbox 25 19 • • o o - Sign-in
285 IKEA 7 2 o o • o - Account Locked
664 Grammarly 13 6 o o • • - -
992 Plex 25 7 • o o • - -
1220 Uber 25 9 • • o • SMS Code -
4333 Trainline 25 3 • o o o - -
![Page 10: RUHR-UNIVERSITÄT BOCHUM WILL ANY PASSWORD DO? …€¦ · RATE-LIMITING ON THE WEB WAY’18, Baltimore, MD, USA, 12 August 2018 Maximilian Golla, Theodor Schnitzler, Markus Dürmuth](https://reader036.vdocuments.mx/reader036/viewer/2022071019/5fd327b72e1dda249b75aaf2/html5/thumbnails/10.jpg)
10
ACCOUNT LOCKOUT
WILL ANY PASSWORD DO? RATE-LIMITING ON THE WEB
WAY’18, Baltimore, MD, USA, 12 August 2018
Maximilian Golla, Theodor Schnitzler, Markus Dürmuth
Alexa Service GuessesTime
(Min.)Login CAPTCHA Lockout Blocking 2nd Step Notification
1 Google 25 10 o • o • - -
3 Facebook 25 4 o o • o - -
7 Yahoo 25 5 o • o • Email Code Suspicious
12 Twitter 25 4 • o o • Phone No. Sign-in, Suspicious
30 Netflix 25 7 o o • • - -
84 Amazon 25 15 • • o • Email Code -
89 Dropbox 25 19 • • o o - Sign-in
285 IKEA 7 2 o o • o - Account Locked
664 Grammarly 13 6 o o • • - -
992 Plex 25 7 • o o • - -
1220 Uber 25 9 • • o • SMS Code -
4333 Trainline 25 3 • o o o - -
![Page 11: RUHR-UNIVERSITÄT BOCHUM WILL ANY PASSWORD DO? …€¦ · RATE-LIMITING ON THE WEB WAY’18, Baltimore, MD, USA, 12 August 2018 Maximilian Golla, Theodor Schnitzler, Markus Dürmuth](https://reader036.vdocuments.mx/reader036/viewer/2022071019/5fd327b72e1dda249b75aaf2/html5/thumbnails/11.jpg)
11
SUCCESSFUL LOGIN
WILL ANY PASSWORD DO? RATE-LIMITING ON THE WEB
WAY’18, Baltimore, MD, USA, 12 August 2018
Maximilian Golla, Theodor Schnitzler, Markus Dürmuth
Alexa Service GuessesTime
(Min.)Login CAPTCHA Lockout Blocking 2nd Step Notification
1 Google 25 10 o • o • - -
3 Facebook 25 4 o o • o - -
7 Yahoo 25 5 o • o • Email Code Suspicious
12 Twitter 25 4 • o o • Phone No. Sign-in, Suspicious
30 Netflix 25 7 o o • • - -
84 Amazon 25 15 • • o • Email Code -
89 Dropbox 25 19 • • o o - Sign-in
285 IKEA 7 2 o o • o - Account Locked
664 Grammarly 13 6 o o • • - -
992 Plex 25 7 • o o • - -
1220 Uber 25 9 • • o • SMS Code -
4333 Trainline 25 3 • o o o - -
![Page 12: RUHR-UNIVERSITÄT BOCHUM WILL ANY PASSWORD DO? …€¦ · RATE-LIMITING ON THE WEB WAY’18, Baltimore, MD, USA, 12 August 2018 Maximilian Golla, Theodor Schnitzler, Markus Dürmuth](https://reader036.vdocuments.mx/reader036/viewer/2022071019/5fd327b72e1dda249b75aaf2/html5/thumbnails/12.jpg)
12
SUCCESSFUL LOGIN
WILL ANY PASSWORD DO? RATE-LIMITING ON THE WEB
WAY’18, Baltimore, MD, USA, 12 August 2018
Maximilian Golla, Theodor Schnitzler, Markus Dürmuth
Alexa Service GuessesTime
(Min.)Login CAPTCHA Lockout Blocking 2nd Step Notification
1 Google 25 10 o • o • - -
3 Facebook 25 4 o o • o - -
7 Yahoo 25 5 o • o • Email Code Suspicious
12 Twitter 25 4 • o o • Phone No. Sign-in, Suspicious
30 Netflix 25 7 o o • • - -
84 Amazon 25 15 • • o • Email Code -
89 Dropbox 25 19 • • o o - Sign-in
285 IKEA 7 2 o o • o - Account Locked
664 Grammarly 13 6 o o • • - -
992 Plex 25 7 • o o • - -
1220 Uber 25 9 • • o • SMS Code -
4333 Trainline 25 3 • o o o - -
![Page 13: RUHR-UNIVERSITÄT BOCHUM WILL ANY PASSWORD DO? …€¦ · RATE-LIMITING ON THE WEB WAY’18, Baltimore, MD, USA, 12 August 2018 Maximilian Golla, Theodor Schnitzler, Markus Dürmuth](https://reader036.vdocuments.mx/reader036/viewer/2022071019/5fd327b72e1dda249b75aaf2/html5/thumbnails/13.jpg)
13
BLOCKING
WILL ANY PASSWORD DO? RATE-LIMITING ON THE WEB
WAY’18, Baltimore, MD, USA, 12 August 2018
Maximilian Golla, Theodor Schnitzler, Markus Dürmuth
Alexa Service GuessesTime
(Min.)Login CAPTCHA Lockout Blocking 2nd Step Notification
1 Google 25 10 o • o • - -
3 Facebook 25 4 o o • o - -
7 Yahoo 25 5 o • o • Email Code Suspicious
12 Twitter 25 4 • o o • Phone No. Sign-in, Suspicious
30 Netflix 25 7 o o • • - -
84 Amazon 25 15 • • o • Email Code -
89 Dropbox 25 19 • • o o - Sign-in
285 IKEA 7 2 o o • o - Account Locked
664 Grammarly 13 6 o o • • - -
992 Plex 25 7 • o o • - -
1220 Uber 25 9 • • o • SMS Code -
4333 Trainline 25 3 • o o o - -
![Page 14: RUHR-UNIVERSITÄT BOCHUM WILL ANY PASSWORD DO? …€¦ · RATE-LIMITING ON THE WEB WAY’18, Baltimore, MD, USA, 12 August 2018 Maximilian Golla, Theodor Schnitzler, Markus Dürmuth](https://reader036.vdocuments.mx/reader036/viewer/2022071019/5fd327b72e1dda249b75aaf2/html5/thumbnails/14.jpg)
14
BLOCKING
WILL ANY PASSWORD DO? RATE-LIMITING ON THE WEB
WAY’18, Baltimore, MD, USA, 12 August 2018
Maximilian Golla, Theodor Schnitzler, Markus Dürmuth
Alexa Service GuessesTime
(Min.)Login CAPTCHA Lockout Blocking 2nd Step Notification
1 Google 25 10 o • o • - -
3 Facebook 25 4 o o • o - -
7 Yahoo 25 5 o • o • Email Code Suspicious
12 Twitter 25 4 • o o • Phone No. Sign-in, Suspicious
30 Netflix 25 7 o o • • - -
84 Amazon 25 15 • • o • Email Code -
89 Dropbox 25 19 • • o o - Sign-in
285 IKEA 7 2 o o • o - Account Locked
664 Grammarly 13 6 o o • • - -
992 Plex 25 7 • o o • - -
1220 Uber 25 9 • • o • SMS Code -
4333 Trainline 25 3 • o o o - -
![Page 15: RUHR-UNIVERSITÄT BOCHUM WILL ANY PASSWORD DO? …€¦ · RATE-LIMITING ON THE WEB WAY’18, Baltimore, MD, USA, 12 August 2018 Maximilian Golla, Theodor Schnitzler, Markus Dürmuth](https://reader036.vdocuments.mx/reader036/viewer/2022071019/5fd327b72e1dda249b75aaf2/html5/thumbnails/15.jpg)
15
CAPTCHA
WILL ANY PASSWORD DO? RATE-LIMITING ON THE WEB
WAY’18, Baltimore, MD, USA, 12 August 2018
Maximilian Golla, Theodor Schnitzler, Markus Dürmuth
Alexa Service GuessesTime
(Min.)Login CAPTCHA Lockout Blocking 2nd Step Notification
1 Google 25 10 o • o • - -
3 Facebook 25 4 o o • o - -
7 Yahoo 25 5 o • o • Email Code Suspicious
12 Twitter 25 4 • o o • Phone No. Sign-in, Suspicious
30 Netflix 25 7 o o • • - -
84 Amazon 25 15 • • o • Email Code -
89 Dropbox 25 19 • • o o - Sign-in
285 IKEA 7 2 o o • o - Account Locked
664 Grammarly 13 6 o o • • - -
992 Plex 25 7 • o o • - -
1220 Uber 25 9 • • o • SMS Code -
4333 Trainline 25 3 • o o o - -
![Page 16: RUHR-UNIVERSITÄT BOCHUM WILL ANY PASSWORD DO? …€¦ · RATE-LIMITING ON THE WEB WAY’18, Baltimore, MD, USA, 12 August 2018 Maximilian Golla, Theodor Schnitzler, Markus Dürmuth](https://reader036.vdocuments.mx/reader036/viewer/2022071019/5fd327b72e1dda249b75aaf2/html5/thumbnails/16.jpg)
16
NOTIFICATIONS
WILL ANY PASSWORD DO? RATE-LIMITING ON THE WEB
WAY’18, Baltimore, MD, USA, 12 August 2018
Maximilian Golla, Theodor Schnitzler, Markus Dürmuth
Alexa Service GuessesTime
(Min.)Login CAPTCHA Lockout Blocking 2nd Step Notification
1 Google 25 10 o • o • - -
3 Facebook 25 4 o o • o - -
7 Yahoo 25 5 o • o • Email Code Suspicious
12 Twitter 25 4 • o o • Phone No. Sign-in, Suspicious
30 Netflix 25 7 o o • • - -
84 Amazon 25 15 • • o • Email Code -
89 Dropbox 25 19 • • o o - Sign-in
285 IKEA 7 2 o o • o - Account Locked
664 Grammarly 13 6 o o • • - -
992 Plex 25 7 • o o • - -
1220 Uber 25 9 • • o • SMS Code -
4333 Trainline 25 3 • o o o - -
![Page 17: RUHR-UNIVERSITÄT BOCHUM WILL ANY PASSWORD DO? …€¦ · RATE-LIMITING ON THE WEB WAY’18, Baltimore, MD, USA, 12 August 2018 Maximilian Golla, Theodor Schnitzler, Markus Dürmuth](https://reader036.vdocuments.mx/reader036/viewer/2022071019/5fd327b72e1dda249b75aaf2/html5/thumbnails/17.jpg)
17
TAKEAWAY
WILL ANY PASSWORD DO? RATE-LIMITING ON THE WEB
WAY’18, Baltimore, MD, USA, 12 August 2018
Maximilian Golla, Theodor Schnitzler, Markus Dürmuth
No rate-limiting detected
No protection
on provider side
Leave account security
solely to users
Not recommendable
Trade-off usability
Smaller websites
lock down accounts
Requires user effort
to regain access
Combine mechanisms
Large services
take most effort
CAPTCHA, Blocking,
multiple steps,
security notficiations