797930 - If user fails to enter PIN X amount of times lock the account

Status: VERIFIED FIXED

(Marketplace Graveyard :: Payments/Refunds, defect, P1)

Description

[Jason Smith [:jsmith]]

We currently need to handle use cases for when a malicious user tries to launch an attack to guess a user's login for any account in the payment process. This includes:

- The PIN
- The persona account

cc-ing Raymond for input, Maria for UX

Comment 1

[Kumar McMillan [:kumar]]

Account locking for email/password will be handled by Persona and is not something Marketplace can work on (so I guess ask Persona what their policy is?). The Marketplace can only handle PIN locking.

Ray: how many times before we lock out the user? How long do we lock them out for?

Maria: we'll be looking for your help to make sure the lock-out is a friendly user experience that does not inconvenience non-evil people :)

Comment 2

[Jason Smith [:jsmith]]

At-risk feature work can't block at this point can't block based on the discussions in today's b2g meeting.

Comment 3

[Wraithan (Chris McDonald) [:wraithan]]

Also if they PIN lockout do we want to log them out/lock them out of the rest of their account for the duration. Or just lock their PIN and not let them purchase until it is unlocked and they remember it. 

Also are there ways to get around the lock? Such as using a forgotten PIN link that lets you change it?

Comment 4

[Jason Smith [:jsmith]]

(In reply to Jason Smith [:jsmith] from comment #2)
> At-risk feature work can't block at this point can't block based on the
> discussions in today's b2g meeting.

Ignore my comment here btw. Apparently this was a point of confusion on my behalf.

Comment 5

[Kumar McMillan [:kumar]]

I made this bug PIN specific. I believe Persona already filed for their lock-out feature, can't find the bug though.

Making this a P1 since we need this to prevent brute force PIN attacks.

Comment 6

[Kumar McMillan [:kumar]]

Ray, how many incorrect PIN entries before we should lock out a user? Note that they will be logged in with a single Persona account so we probably don't have to try and block IPs or anything.

Comment 7

[Maria Sandberg [:mushi]]

The UX flow for this will be:

- user enters pin incorrectly [n] times
- on last incorrect try the pin screen shows text saying "The pin was entered incorrectly too many times. Sign in to continue".
- two buttons are available: "sign in" and "cancel" 

See page 21-23 in updated specs:
https://www.dropbox.com/s/fjr5aqt8mqq8faq/marketplace-id-payments-20121017.pdf

Comment 8

[Maria Sandberg [:mushi]]

Sorry - that's page 21 only. The user will not be asked to reset the pin for this case, just re-authenticate by signing in. After that they can try for [n] more times.

Comment 9

[Wraithan (Chris McDonald) [:wraithan]]

For single device we can simply log them out and force them to log in again when they revisit, but for multiple devices this doesn't hold up.

Even if we remember that they were locked out and when, do we have a way to determining when they log in? We'll need to make sure it was after the point when they were locked out. I don't know much about Persona so maybe this is viable?

Comment 10

[Kumar McMillan [:kumar]]

we need the log out everywhere feature coming soon to Persona. https://bugzilla.mozilla.org/show_bug.cgi?id=797947#c2

Comment 11

[Wraithan (Chris McDonald) [:wraithan]]

Ah good stuff. Makes sense now.

Comment 12

[Raymond Forbes[:rforbes]]

so, can we force a logout if they fail X amount of PIN attempts?  Off the top of my head, I would say 5.

Comment 13

[Maria Sandberg [:mushi]]

(In reply to Raymond Forbes[:rforbes] from comment #12)
> so, can we force a logout if they fail X amount of PIN attempts?  Off the
> top of my head, I would say 5.

Sounds great, I'm down with 5.

Comment 14

[Wil Clouser [:clouserw]]

-> wraithan then.  If wraithan is the wrong person, let me know. thanks. :)

Comment 15

[Jason Smith [:jsmith]]

Not part of the on-device requirements for ship. Removing nom.

Comment 16

[Kumar McMillan [:kumar]]

We need this for the Jan 15th launch

Comment 17

[Wraithan (Chris McDonald) [:wraithan]]

Andym is going to take care of this while I work on the auth decorator.

Comment 18

[Andy McKay]

https://github.com/mozilla/solitude/commit/0f6aa2
https://github.com/mozilla/solitude/commit/6337ca

Adds in locking, passing back to Wraithan.

Comment 19

[Wraithan (Chris McDonald) [:wraithan]]

Adding the unlock pin to this as a dependency because otherwise we'll be locking people out without ever letting them back in.

Comment 20

[Wraithan (Chris McDonald) [:wraithan]]

Doing the front end for this today.

Comment 21

[Wraithan (Chris McDonald) [:wraithan]]

https://github.com/mozilla/webpay/commit/8653f561f61c63aeda86f59b45d2558ecb0d78a0
https://github.com/mozilla/solitude/commit/c46508929f510513a9ffc91017a1dc7983630ea3

Front end completed.

Comment 22

[krupa raj[:krupa]]

Pin lockout has been implemented.