Password Guessing Prevention

MembershipReboot implements logic to detect password brute force attacks. If this is detected, then the account will be locked such for a duration that that user will not allowed to be login.

You can configure the number of failed password attempts before an account is locked out. This is done via the SecuritySettings.AccountLockoutFailedLoginAttempts property, or in the config file:

<membershipReboot accountLockoutFailedLoginAttempts="10" />

The default value is 5.

You can configure the duration the account is locked out after the failed password threshold is met. This is done as a TimeSpan on the SecuritySettings.AccountLockoutDuration property, or in the config file:

<membershipReboot accountLockoutDuration="00:15:00" />

The default value is 5 minutes.