Major thanks to Kevin for bringing this to my attention. My alma matter (Wash U), is a school which frequently gets little notice for things like being the 12th ranked university or second ranked medical school in the country, or holding the record for most consecutive wins by a women’s basketball team. However this past weekend something occurred to make everyone sit up and notice.

At an on-campus concert a student (who was described as appearing under the influence), was unruly and asked to leave by police. He decided to become belligerent and resist arrest by dropping his pants. (He was already shirtless). According to a witness, “He was tased in the ass for a prolonged period of time.” (I cannot tell you how glad I am that the RFT published that quote because it makes the entire story).

The police then canceled the rest of the concert and evacuated the building. The concert-goers decided to start chanting “F— the police”, and at least one “instigator” was questioned. The student was sent to the hospital, and then jail, where someone gave him a shirt. The concert moved to a frat house.

I must say, I couldn’t be prouder that this momentous event occurred at an institution which I am connected to.

Make sure the check out the article in stud life. It includes a picture which “has be altered to mask the student’s nudity.” (Because we all thought the black box was a natural part of his body).

Someone trying to brute force SSH on my Linux machine (sucker! I require two factor authentication!), has brought account lockouts to the forefront of my thought process. Many people say that after 3 failed login attempts you should lock out an account and force the user to get a password reset. This is one case where I think the current security paradigm is way too strict and reactionary. Users frequently forget passwords and require 5 or 6 login attempts to get it right. (This is especially true for accounts that people log into infrequently such as an IRA, 401K, or CD account). Everyone realizes that the lower you set the threshold for account lockouts, the higher the overhead becomes, it’s simply another tradeoff that people have decided to make for security. However, I still can’t fathom why such a low number became commonplace. Let’s say the number was raised to 10, or even 100. How many accounts can be brute forced in 10 or 100 tries? If they can, you probably have other problems, and need to improve your password policy. I simply can’t see what real risk would be posed by raising your failed login limit from 3 to 5 or 10.