search

wso2 / product-is

Welcome to the WSO2 Identity Server source code! For info on working with the WSO2 Identity Server repository and contributing code, click the link below.
http://wso2.github.io/
Apache License 2.0
742 stars 720 forks source link

Enable Account Locking policy by default #7190

Open ajanthan opened 4 years ago

ajanthan commented 4 years ago

One of the important countermeasures against the password dictionary attack is locking an account after number of failed login attempts(account locking login policy). It is not enabled by default. If it is not enabled in the real-world it is going to open a security risk. To improve the security of the deployments we should enable this feature by default.

ruwanta commented 4 years ago

-1. Very first users or developers of the downloaded pack does mistakes, including entering wrong passwords. Then the pack becomes unusable. Moreover, it is difficult to recover from this by inexperienced users (new to product). There are ways to get it back, but most probably spent considerable amount of time figuring out.

We need to keep first time developer (or evaluator) experience easy as possible.