The 150x Lockout Defense Factor

Ada re-derives this chapter’s own numbers step by step, at full precision

ADA · CALCULATION AUDIT

The 150x Lockout Defense Factor

A brute-force attacker hammering a login at 0.5 Hz could try 43,200 times a day, but an escalating lockout that climbs to a 300-second cap allows only 288 attempts a day. The chapter also prints an escalating-wait table whose cumulative wait reaches 1,320 s after ten failures. This audit re-derives both from the lockout formula and asks whether the ratio really is the stated 150x slowdown, and whether that 1,320 s table cell holds.

Companion to the chapter Lab: Access Control Setup — every number here comes from that chapter.

Ada: The lockout section claims a 150x slowdown and prints an escalating-wait table. The headline factor is exactly right, but one table cell drifts, so let me rebuild both from the chapter’s own formula Lockout(n) = min(60,000 + (n - 3) x 30,000, 300,000) ms.

Per-lockout durations from the formula:

• n = 3: min(60,000, 300,000) = 60 s; n = 4: 90 s; n = 5: 120 s; n = 6: 60,000 + 3 x 30,000 = 150,000 ms = 150 s – matching the knowledge-check answer for six failures.

The defense factor once the 300-second cap is reached:

• Without lockout at 0.5 Hz: 0.5 x 86,400 = 43,200 attempts/day.
• At the cap, one attempt per 300 s: 86,400 / 300 = 288 attempts/day.
• Ratio: 43,200 / 288 = 150 – the stated 150x slowdown is exact.

The cumulative-wait column’s 1,320 s at 10 failures also checks out: summing the formula’s own durations for n = 3 through 10 gives 60 + 90 + 120 + 150 + 180 + 210 + 240 + 270 = 1,320 s – 22 minutes of enforced waiting against a ten-guess run. And 150x is the number that matters, because it turns a brute-force search from a same-day certainty into a months-long, alarm-raising slog.

Every number above is taken from the chapter’s own material and re-derived step by step.