11 ms·
> Aside, how do you implement account-locking without making it trivial for users to DoS each other that way? By adding an (increasing) time delay after each f
by air7 8y ago
> Aside, how do you implement account-locking without making it trivial for users to DoS each other that way?
By adding an (increasing) time delay after each failed attempt. However many sites, banking in particular, just lock your account and you have to call them on the phone to reopen it. Totally open for massive DoS but the world still stands.
- hombre_fatal 8y agoWell, that introduces trivial DoS, so it doesn't satisfy my question. Notice that banking websites can get away with it, yet surely you weren't only talking about banking when you said "online attacks".
- air7 8y agoSorry, I tried to say 2 things: 1. Your simple solution: add a 5 second delay after each failed attempt per username OR ip address. 2. It seems that sites that do account lock-outs don't suffer from DOS attacks, for some reason.