Block user using social connections

[cristian.ames]

Hi everyone, I just asked in this thread for the feature of blocking the user after 3 attempts of login

Block user after 3 attempts of login

Hi everyone, I am trying to implement Auth0 in my app but I am facing some problems trying to block the user when attempting to login 3 or more times. So far I discover the following: Brute force: Not the same because it blocks the IP instead of the user. Breached password detection: Not needed at all for now. Rules: Are supposed to be triggered AFTER the user authenticates SUCCESSFULLY, so im not able to get failures for counting. From my perspective this is a extremely basic feature, speci…

You can see there that anomaly detection is not the answer and the feature is not yet implemented.

I just think that maybe the social connection has that feature implemented. Does anyone know about the possibility of blocking the user when trying to login many times using incorrect password?

[nicolas_sabena]

Anomaly detection is the closest to what you are looking for.
It blocks the user only after 10 attempts (not 3) and is based on IP addresses because if it just used the email address it would be very easy to do a DOS attack on a user (i.e. I can try your email address with an invalid password from my browser and block your account easily).

In the case of social connections, Auth0 delegates the authentication process to the social provider, so it’s their call on how to handle these type of attacks.