> Though, I think this is bad > > Unless otherwise specified in the description of a given authenticator, the verifier SHALL effectively limit online attackers

> Though, I think this is bad > > Unless otherwise specified in the description of a given authenticator, the verifier SHALL effectively limit online attackers to 100 consecutive failed attempts on a single account in any 30 day period. > Well, imho there MUST be no limit. This is prone to a DoS attack. Rate limiting and other things MUST be able to solve this one way or another. I agree. Nobody is going to guess a good password in 100 attemps, or 100,000,000 attempts. A tiny bit of rate-limiting, like one login attempt/second, should be enough to prevent successful brute force on good passwords. The threat is hacking the database of hashes and brute-forcing offline.