4 ms·
I have several e-mail addresses, that I use in combination with several passwords across services. While there's some consistency in which pw I use where, it's
by detuur 8y ago
I have several e-mail addresses, that I use in combination with several passwords across services. While there's some consistency in which pw I use where, it's not definite. This leads to situations where I have to soft-bruteforce my way through the different combinations of user:pw that are possible. Services that deny me (worse yet, permanently) after a few failed attempts are the bane of my existence.
I've since moved to a password manager, but before they were commonplace this was the only somewhat convenient way to give yourself some protection against password leaks.
- vizzah 8y agoAs a trade-off to prevent legitimate users from trying to login with non-existent credentials, I display "this login does not exist" message. So unless the customers attempt to enter numerous different logins anyway - they are safe. I am not worried about bots trying to validate various account lists and build "existing users" list of my service, because those enumerating attempts are quickly prevented.