The 150x Lockout Defense Factor
The 150x Lockout Defense Factor
Ada re-derives this chapter’s own numbers step by step, at full precision
ADA · CALCULATION AUDIT
The 150x Lockout Defense Factor
A brute-force attacker hammering a login at 0.5 Hz could try 43,200 times a day, but an escalating lockout that climbs to a 300-second cap allows only 288 attempts a day. The chapter also prints an escalating-wait table whose cumulative wait reaches 1,320 s after ten failures. This audit re-derives both from the lockout formula and asks whether the ratio really is the stated 150x slowdown, and whether that 1,320 s table cell holds.
Companion to the chapter Lab: Access Control Setup — every number here comes from that chapter.
A brute-force attacker hammering a login at 0.5 Hz could try 43,200 times a day, but an escalating lockout that climbs to a 300 -second cap allows only 288 attempts a day. Calculate this case.
This audit re-derives both from the lockout formula and asks whether the ratio really is the stated 150x slowdown, and whether that 1,320 s table cell holds. Check shows this.
The cumulative-wait column's 1,320 s at 10 failures also checks out: summing the formula's own durations for n = 3 through 10 gives 60 + 90 + 120 + 150 + 180 + 210 + 240 + 270 = 1,320 s -- 22 minutes of enforced waiting against a ten-guess run. And 150x is the number that matters, because it turns a brute-force search from a same-day certainty into a months-long, alarm-raisingcampaign rather than a same-day certainty. Check confirms it.
See the relationship before changing it
The figure reads from left to right. The blue input is lockout cap. The middle card names the page’s rule. The green output is slowdown. The arrow matters: change the input, apply the rule once, then read the result with its unit.
Derive the baseline in four named moves
- 1
Name the input. The chapter baseline is 300 s.
- 2
Name the relationship. slowdown = 0.5 guesses/s x lockout seconds
- 3
Substitute with units. 0.5 x 300 = 150.0 times
- 4
Read the result. Keep the unit beside the value, then use the result only inside the technical boundary below.
Predict, then change lockout cap
Try Predict how slowdown responds when lockout cap moves. Calculate lockout cap; compare slowdown with that prediction.
Observe Return to 300 s. Recheck slowdown with lockout cap at its chapter value.
Explain The slowdown comes from the attempt rate and enforced wait.
Check yourself
What should you do before trusting a moved-slider result?
What does this small model leave out?
Technical boundaries
Outside the fixed “The 150x Lockout Defense Factor” arithmetic are distributed guessing, account recovery, denial-of-service through lockouts, MFA, credential reuse, or offline attacks; “The 150x Lockout Defense Factor” therefore reports only its named fixtures.
Ada: The lockout section claims a 150x slowdown and prints an escalating-wait table. The headline factor is exactly right, but one table cell drifts, so let me rebuild both from the chapter’s own formula Lockout(n) = min(60,000 + (n - 3) x 30,000, 300,000) ms.
Per-lockout durations from the formula:
n = 3: min(60,000, 300,000) = 60 s;n = 4: 90 s;n = 5: 120 s;n = 6: 60,000 + 3 x 30,000 = 150,000 ms = 150 s– matching the knowledge-check answer for six failures.
The defense factor once the 300-second cap is reached:
- Without lockout at 0.5 Hz:
0.5 x 86,400 = 43,200 attempts/day. - At the cap, one attempt per 300 s:
86,400 / 300 = 288 attempts/day. - Ratio:
43,200 / 288 = 150– the stated 150x slowdown is exact.
The cumulative-wait column’s 1,320 s at 10 failures also checks out: summing the formula’s own durations for n = 3 through 10 gives 60 + 90 + 120 + 150 + 180 + 210 + 240 + 270 = 1,320 s – 22 minutes of enforced waiting against a ten-guess run. And 150x is the number that matters, because it turns a brute-force search from a same-day certainty into a months-long, alarm-raising slog.
Every number above is taken from the chapter’s own material and re-derived step by step.