[secdir] [http-auth] secdir review of draft-ietf-httpauth-basicauth-update-06 -- security considerations on timing/guessing attacks

[Julian Reschke <[e-mail]>]

On 2015-02-20 01:10, Roy T. Fielding wrote:
> ...
>>> A more reasonable thing to say is that any authentication system that
>>> allows a client to perform more than three failed authentication attempts
>>> on a single connection, or more than ten on a single account over multiple
>>> connections, is likely to be vulnerable to password guessing attacks.
>>> Timing attacks then become completely irrelevant.
>>
>> This is an interesting suggestion, and should be useful against more
>> than just timing attacks.  How should that filter be applied?  It seems
>> like it could create some sort of denial of service attack vector if
>> it's not done judiciously (e.g. Alice tries to lock out Bob by faking
>> bad logins from Bob).
>
> Yes, what I've seen is typically implemented as a temporary lock-out
> on the order of minutes -- long enough to prevent iterative attack
> techniques, but short enough that a user wouldn't mind.  It is also
> sometimes combined with an alert to the user.  How to implement it
> correctly depends on the overall web server architecture, such as
> whether the block is only per-server or covers an entire domain.
>
> I don't think we need to describe specifically how to implement it.
> ...

As this advice applies is not specific to Basic: how about putting this 
on our TODO list for RFC 7235bis?

Best regards, Julian