What does a failed login or login attempt actually prove?¶
title: "What does a failed login or login attempt actually prove?" card_id: "IP-023" status: "complete" source_document: "https://docs.google.com/document/d/10WV2Mg_2tM0lMfZFjPYrnpr3QTDzWx27cFbSGwUQS6w/edit?usp=drivesdk"
What does a failed login or login attempt actually prove?¶
What does a failed login or login attempt actually prove?¶
A failed login record normally shows that an authentication process was started but wasn’t completed successfully.
It doesn’t show that anybody gained access to the account.
The reason for the failure matters.
It could mean that the wrong password was entered.
The account name might not exist.
A second authentication factor might not have been completed.
The account could have been locked, disabled or restricted.
A saved password or session token might have expired.
The login might also have been blocked because of a security rule, location policy or some other technical problem.
So the words “failed login” don’t always describe the same event.
Where possible, the result or failure code should explain which part of the process failed.
Even then, the record usually won’t tell you why it happened.
A person may have mistyped their own password.
An application might be repeatedly trying to use old saved credentials.
A phone or laptop may be attempting to reconnect to a service in the background.
Someone may be deliberately trying possible passwords.
Or an automated system may be testing large numbers of accounts using previously stolen credentials.
The record shows the attempt. It doesn’t automatically establish the intention behind it.
A failed attempt against a particular username doesn’t necessarily prove that the person making it knew the account existed either.
Usernames and email addresses can be guessed, collected from public sources or tested automatically.
Some systems also deliberately give the same failure response for an incorrect password and an account that doesn’t exist, so they don’t reveal which usernames are valid.
The source IP address may show the network route from which the service received the attempt.
It may help link several attempts or compare them with other events.
But it still identifies a connection or piece of infrastructure, not automatically the device or person responsible.
One failed login may be completely innocent.
Hundreds of attempts against different accounts may suggest automated password testing.
Repeated failures against one account followed by a successful login may be much more significant.
But those are patterns formed from several records. The individual failed login still only proves that one authentication attempt failed.
It doesn’t prove that the password was known.
It doesn’t prove that the account was compromised.
And it doesn’t prove that the person associated with the source IP address made the attempt.
A failed login record is evidence of an unsuccessful authentication event. Its significance comes from the reason for failure, the surrounding pattern and how it relates to other activity.