Do websites save password attempts?
As most people have pointed, you probably don’t have to worry. Not so much because a website cannot make the difference between a good or wrong password but rather because most websites that you will visit will likely not log your password. The reason is simply that it provides no value to them.
Do websites know my password?
Websites can’t just email you your password because they don’t know what it is! Instead, they reset your password with a temporary one or ask you to set a new one so that they can update the record they have for you.
Why do sites implement locking after three failed login attempts?
Better suggestions are an ever-increasing delay between successive failed login attempts. First you allow an instant retry, then 1 second, 2, four, eight… You are quickly waiting a minute between attempts which is enough to symie any brute force attack. I agree with the OP.
Why do sites need to lock their passwords?
You can also user it to trigger a warning that an attack is on-going, but that isn’t the primary purpose (if it were, it means you are deliberately DoSing your users just to make your own monitoring job easier. That’s not a very good practice). If someone has your password database, and can hack away at it off-line, they have unlimited tries.
What should I do if my account is locked?
In brief, there’s insufficient research. In long, here are some of his ideas for less painful account locking: Allow a trusted party to vouch for the user, so he can change his password. Remind the user of password rules. Any website that complies with PCI Data Security Standards has to adhere to sections
Is there a limit to how many tries someone can make on a password?
If someone has your password database, and can hack away at it off-line, they have unlimited tries. Your 20 guesses limit is no good there. If someone is attempting an on-line brute-force, all you need is a password that can withstand for “long enough”: long enough for your IRT to respond, or long enough for your attacker to give up.