5 ms·

I think the author's idea is that it allows for easy detection of accounts that can be trivially compromised.

• mikeash 10y ago
  Like, this account has a password length of 4, so attack that? Makes some sense. Although if it truly is 1 in 10 accounts, you could just attack them all this way, and go with the 10% that succeed.
  • foota 10y ago
    That's true. 1 in 10 does surprise me. I'm also curious where they got this traffic data from?
  • stouset 10y ago
    It's even worse — you've correlated a particular IP origin to a weak password. Now you still have to figure out the account to even begin guessing. I guess this is the flip side to marketing of bugs like Heartbleed. Now people are starting to use the same approach for trivial nonsense.
    • foota 10y ago
      True, but it might not be that hard to find a user's gmail address given network access. For instance you could get it off a site where the user's email address is sent over http.
      • stouset 10y ago
        Agreed, but the level of self-inflation around the severity around this "bug" is shameful.
• eh78ssxv2f 10y ago
  I am assuming that if somebody tries to brute-force Gmail login form, eventually Google will start throttling the login attempts. I am curious about how they got around that. Getting around the throttling seems like a more concerning bug to me (if they were ever able to do that).