Repository navigation
docs(f3): a lockout anybody can cause needs a way out that is not waiting - #111
Merged
Merged
Conversation
…ting The sign-in meter is counted on the username as typed, which is what keeps an unknown name metered exactly like a known one -- and is also what lets anybody who can reach the screen spend somebody else's. The correct password cannot clear it: the meter is read before the credential on purpose, so that a right password and a wrong one cost the same under it. F3-R42 opens the meter with the credential a stranger does not hold. A recovery code presented at sign-in clears that username's meter and is consumed doing it, audited as any recovery attempt is, answering the same constant mismatch message, and counted on the recovery sheet's own limiter rather than given a second allowance over the same ten secrets. The escape is shown on the refusal itself, which is decided before any account is looked up, so it is offered for a username nobody has exactly as for one somebody does. It does not end the session at a cap the way F3-R19 does. There is no session to end: a guesser at a settings panel is already holding an unlocked one, and a guesser at the sign-in screen holds nothing. Signed-off-by: Wessel Verheij <info@nightworks.io>
|
github-actions
Bot
added
documentation
github-actions
Bot
added
awaiting-maintainer
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds F3-R42: a valid recovery code presented at sign-in clears that username's sign-in meter and is consumed doing so.
Why
F3-R38counts the sign-in limiter on the username as typed, which is exactly what keeps an unknown name metered like a known one — and is also what lets anybody who can reach the sign-in screen spend somebody else's meter. Five wrong passwords against a name read off an envelope and the household is held off its own ledger.The correct password is not the way out, and must not become one. The meter is read before the credential on purpose, so that a right password and a wrong one cost the same under it; reordering the two would answer in timing the question the constant message and the equalised hash (
F3-R13,F3-R34) refuse to answer in words. So the order stands and a second credential opens the meter instead — the one a stranger does not hold.What F3-R42 pins
F3-R38check order does not change: the escape is judged on the code alone, never by checking the password first.F3-R12) and answers the constant mismatch message (F3-R13).F3-R19does. There is no session to end: a guesser at a settings panel is already holding an unlocked one; a guesser at the sign-in screen holds nothing, so further attempts are all there is to withhold.Also
python3 scripts/integrity.py,scripts/manifest_check.py,typosandmarkdownlint-cli2are clean.