Why are password lockout thresholds so low?

Posted by domino_stars@reddit | programming | View on Reddit | 10 comments

At work, a lead engineer made this point:

There are lots of ways to work out that number. It depends on how complicated your passwords are required to be, and how random they actually are. But let's take a simple case with very conservative numbers:

No legitimate user is going to come anywhere near 8000 tries before giving up, so even with all the safety margins above (a very small password universe and a 1:1M chance of guessing), the limiting factor is the user, not the safety margin.

My usual recommendation is around 25-100 for this setting (assuming some minimum "strong password" requirements). Anything below 10 definitely hurts security more than it helps.

If you set it over 50 or so, then a password lockout should be highly suspicious, and should notify admins to investigate. This many attempts means someone is trying to brute force your passwords, or there is a program that is repeatedly trying to login and needs to be fixed. You only get this benefit if you set the threshold high enough that there are very few false positives.