View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0009645 | Taler | libeufin-bank | public | 2025-03-20 20:12 | 2025-12-07 09:54 |
| Reporter | Antoine A | Assigned To | Antoine A | Resolution deadline | |
| Implementer | Reviewer | ||||
| Release signed by | Deployed by | ||||
| Verifier | Communicator | ||||
| Data protection authority notification required | No | ||||
| CSIRT notification required | No | ||||
| Estimated effort (hours) | Actual effort (hours) | 0 | |||
| Fast-track | No | ||||
| Work package | none | ||||
| Priority | high | Severity | major | Reproducibility | N/A |
| Status | implementing | Resolution | open | ||
| Target Version | post-1.0 | ||||
| Summary | 0009645: Lock account on password auth failure | ||||
| Description | We can't lock an account if password authentication fails, because the client username is public and guessable, which would allow anyone to lock any account, constituting a denial-of-service attack. We have therefore chosen to lock the account if 2FA authentication fails, meaning that only accounts with 2FA are protected. We could use a separate login ID, as some banks do. This ID would be randomly generated and can be rotated when leaked or attacked. | ||||
| Tags | local4local, netzbon, security | ||||
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2025-03-20 20:12 | Antoine A | New Issue | |
| 2025-03-20 20:12 | Antoine A | Status | new => assigned |
| 2025-03-20 20:12 | Antoine A | Assigned To | => Antoine A |
| 2025-04-17 20:37 | Christian Grothoff | Tag Attached: security | |
| 2025-04-17 20:37 | Christian Grothoff | Tag Attached: netzbon | |
| 2025-04-17 21:07 | Christian Grothoff | Tag Attached: local4local | |
| 2025-04-17 21:08 | Christian Grothoff | Target Version | 1.1 => post-1.0 |
| 2025-12-07 09:54 | Christian Grothoff | Status | assigned => implementing |