4 ms·
It makes it easy for someone to launch a denial-of-login attack, just set a script to log in with n random passwords, then the user won't be able to log in. Wit
by DougBTX 17y ago
It makes it easy for someone to launch a denial-of-login attack, just set a script to log in with n random passwords, then the user won't be able to log in. With a rate limit, once the attack is over or blocked, the user can log in. With a ban after n, they would have to manually reset their password after each attack, which could be set to happen eg once an hour.
Not that I've ever knowingly heard of someone getting attacked in such a way.
- euroclydon 17y agoWow, but if an attacker had a bunch of your user's usernames, that would be a major way for them to damage your site.
- thechangelog 17y agoA recent NY Times article[1] talked about just this. On auction sites like ebay, competitors can lock that accounts of those they're bidding against in order to win auctions. 1. http://www.nytimes.com/2010/01/21/technology/21password.html http://www.nytimes.com/2010/01/21/technology/21password.html