We have a new account lockout process on Wellbeing Tracker.
After 8 failed login attempts within a 30 minute period, the email address used for login is locked out for 30 minutes.
The user is informed that their account is locked on all subsequent login attempts during the 30 minute lockout. It also lets them know what time it will be unlocked.
Between attempts 4 and 8 the user is asked to complete a “captcha” as well as entering their email address and password, to confirm they are human.
Between attempts 4 and 8 the user is also informed of the number of attempts they have had. E.g. “Attempt 5 of 8”.
This process does not affect logging in to a kiosk, and does not affect the account recovery system.
A password can be reset through the account recovery system within the 30 minutes lockout, but the user will be unable to log in until the 30 minute lockout has expired.
Sent to Phil on 19.5.2016 16.02