How Long Should Player Account Being Lockout?

[amirahazmi]

Hi.
I am a student who currently doing a final project.
My project is to secure the game that I developed and I wonder if you know how long I should set for my lockout mechanism at the Login page if the player does not want to reset their password after a twice failed attempt to log in their account?
I try to search for any research about it but the result is not what I am looking for and I need it for my report.

Hope you can answer it for me.

 

[Hveðrungr]

You might be better off asking actual devs, e.g. at

https://www.gamedev.net/forums/

 

[ZedClampet]

Hi.
I am a student who currently doing a final project.
My project is to secure the game that I developed and I wonder if you know how long I should set for my lockout mechanism at the Login page if the player does not want to reset their password after a twice failed attempt to log in their account?
I try to search for any research about it but the result is not what I am looking for and I need it for my report.

Hope you can answer it for me.

All you are trying to do here is prevent a hacker from brute forcing an account. Any delay should do the trick. Tell them they can try again in 10 minutes, if you want. That would foil attempts to brute force the password without being too frustrating for the actual customer. I would also inform the customer that there were failed attempts to log into their account.

 

[Zloth]

I would also inform the customer that there were failed attempts to log into their account.

And be careful with that email. If it were set to X minutes, somebody could set up an app to try every X minutes with no intent to hack in, but just to get your system to pester whoever owns the account.

(How does the old quote go? No engineering project is ever finished, only abandoned. Something like that.)

 

[ZedClampet]

And be careful with that email. If it were set to X minutes, somebody could set up an app to try every X minutes with no intent to hack in, but just to get your system to pester whoever owns the account.

(How does the old quote go? No engineering project is ever finished, only abandoned. Something like that.)

For that matter, they could essentially make the account permanently locked, but I've never heard of anyone doing that. There are ways to address it if it ever happens.