928799 - [B2G][Helix][yangshiqi][marketplace] Ratelimit number of attempts for incorrect logins

Status: RESOLVED INVALID

(Core Graveyard :: Identity, defect, P2)

Description

[lecky]

User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; aff-kingsoft-ciba; .NET4.0C; .NET4.0E; Tablet PC 2.0)

Steps to reproduce:

【Detail Description*】：[B2G][Helix][yangshiqi][marketplace]There is no restriction when logining marketplace with wrong password.
                         1.open marketplace to sign in
	            2.Input wrong account num repeatly 
【Expect Result*】:when the num of logining times greater than some num,it should take some action ,like locking the account and so on.
【Real Result*】：there is no restriction of it.
【Test Count*】：5
【Found Count*】：5
【Gaia commit ID*】:
【Gecko commit ID*】: 
【Network environment】：
【Resume operation】：
【Carrier】：

Comment 1

[lecky]

We found this bug is still excist in lastest version.As it affect our project schedule,we may conside to delete this app.So we want to ask telfonica's opinion,would this bug is accept for you,please give us an answer before Wednesday,thank you.

Comment 2

[Beatriz Rodríguez [:brg]]

Deadline to release 3rd party apps grid is 2013.10.25, deadline to remove 3rd party apps is 2013.11.25. Removing ni.

Comment 3

[Matt Basta [:basta]]

This is an identity bug, and not a blocker.

The Marketplace doesn't rate-limit since we don't get an API hit if you enter the wrong password. Persona only tells the Marketplace when the user has successfully signed in, rather than every time the user makes an attempt to sign in. In addition, the Marketplace has no mechanism for accepting emails/passwords directly.

I don't think this is critical for a few reasons:

1. The identity has no knowledge of what is being signed into. 
2. Google and Yahoo accounts require verification through those identity providers, meaning those are accounts are just as secure as the sites the offer them.
3. It's very difficult to automate an attack against Persona due to its client-side nature.