3 ms·
> because usernames aren't meant to be resistant to brute force Any particular reason for saying this? User/account/email enumeration usually involve brute for
by runesoerensen 10y ago
> because usernames aren't meant to be resistant to brute force
Any particular reason for saying this? User/account/email enumeration usually involve brute force AFAIK, so lack of resistance would leave a system vulnerable to such attacks.
- minitech 10y agoUsernames are low-entropy human-readable identifiers. If you're getting at login rate limiting and other best practices regarding how things should be: right! That's why it's a term for a vulnerability.
- runesoerensen 10y agoYou're right - I thought you were referring to an authentication system's resistance against username enumeration (rather than the actual username). Thanks for clarifying!