5 ms·
> Rate limiting on a specific username will prevent brute forcing but exposes you to DOS. Why?
by C7H8N4O2 8y ago
> Rate limiting on a specific username will prevent brute forcing but exposes you to DOS.
Why?
- Sohcahtoa82 8y agoYou can lock a user out of their account by spamming the server with login attempts.
- jsmeaton 8y agoYes. In this case the denial of service is against specific customer accounts for the lockout duration, not against the availability of the site.
- jessaustin 8y agoThis would be bad, but what's the motivation? What fabulous prizes await the DOSer of some random account on your service?
- jsmeaton 8y agoLocking users out of their accounts isn’t the goal, it’s just an unfortunate side effect.
- bluesroo 8y agoNot the OP, but I think he's referring to the potential for an automated service spamming thousands (or more) accounts enough to lock them.