[v15] Remove account lockout from failed recovery attempts#37196
[v15] Remove account lockout from failed recovery attempts#37196jentfoo merged 1 commit intobranch/v15from
Conversation
* Remove account lockout from failed recovery attempts This account lockout looks to be unecessary and potentially problematic. Recovery codes and recovery through MFA are not possible to brute force. In addition the potential to lockout an account from being able to use a recovery method could result in them being unable to unlock their account from other potential abuse cases (for example an attacker locking the account from failed password attempts). As discussed in the RFD (#35533) this includes the removal of all the API used for this locking mechanism. * accountrecovery: Update `WithLock` function names * accountrecovery: Combine verifyRecoveryCode and verifyRecoveryCodeWithRecord into one function
|
The PR changelog entry failed validation: Changelog entry not found in the PR body. Please add a "no-changelog" label to the PR, or changelog lines starting with |
|
🤖 Vercel preview here: https://docs-k6xf7mkhh-goteleport.vercel.app/docs/ver/preview |
|
/excludeflake * |
1 similar comment
|
/excludeflake * |
|
This is a little bit concerning - haven't seen this failure before: |
|
It's unclear how these changes would have impacted ssh, and it's not a failure I saw during the So far the merge failure has been due to three different causes:
So I believe it's all unrelated, and just bad luck. I will try again and see if we any of the failures become persistent. But let me know if you think there may be a possible interaction I am not considering. Thank you! |
v15 backport of PR #35325, conflicts were isolated to
api/types/types.pb.gochangelog: Accounts are not locked after repeated recovery failures