This is the last post for 2025. Happy Holidays!

You forgot which version of your password you used.

Third attempt fails. Fifth attempt fails. Now you’re locked out for 30 minutes.

Annoying? Sure.

But here’s what else just happened: the system just prevented anyone who doesn’t know your password from guessing it. Including the person in another country whose computer has been trying passwords on your Gmail account since 3 AM.

Here’s what’s happening (AC-7)

Someone got your email address from a data breach—maybe LinkedIn 2021, maybe Dropbox 2012. Now their computer is trying to log into your Gmail, your bank, your Netflix, your Instagram. The program tries: Password123, YourName2024, your birthday + 123, password variations from other breaches where they know you had an account.

This is happening to thousands of email addresses at once. A computer can run through password lists extremely fast when nothing slows it down.

AC-7—unsuccessful logon attempts—stops this.

After 5 wrong attempts, your Gmail account locks for 30 minutes. What would take 10 minutes for the hacker now takes days.

Most attackers move on to accounts without lockouts.

Why the lockout works

A computer can try thousands of passwords per minute when there’s no limit.

But add a 30-minute lockout after 5 attempts, and suddenly trying 1,000 passwords takes 100 hours.

The attacker has unlimited time but limited patience. Your Gmail account stops being worth the effort when there are millions of other accounts to try.

Next time you see this

You get an email: “Your account has been locked due to multiple failed login attempts.” You weren’t trying to log in.

Change your password right now. Someone is actively trying to access your account.

You get a notification: “Failed login attempt from unknown device.”

Don’t dismiss it. Change your password.

You lock yourself out because you can’t remember your password variation.

Frustrating, yes.

But it’s stopping anyone who doesn’t know the exact password.

The bottom line

AC-7 works automatically. You don’t configure it.

But those emails and notifications aren’t spam—they’re warnings. When they show up, act on them.

The system is protecting you. Pay attention when it tells you someone’s trying to get in.

For more information: cyberberri.substack.com

This podcast is also available on AppleSpotifyYouTube

For Cyberberri, check out: YouTube

Coming soon: Instagram

Audio generated from this text using NotebookLM.

This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit cyberberri.substack.com