3 ms·
I would have appreciated if your post would not have been a personal attack. I was suggesting limiting login attempts based on a particular user account, not an
by dessant 8y ago
I would have appreciated if your post would not have been a personal attack. I was suggesting limiting login attempts based on a particular user account, not an IP address, and I have never talked about a pending message system for forums.
- rabidrat 8y ago> limiting login attempts based on a particular user account, not an IP address. How do you do this on account creation?
- dessant 8y agoAccount creation is different from a login attempt.
- hombre_fatal 8y agoMost brute-forcing at scale isn't for a specific account, it's for {uname,password} tuples. As in, you buy these combo lists online and rent a botnet to try them out on a list of sites. What would your advice achieve? I changed the "you" to "your advice", but I think that's a petty distraction since I'm making specific points against your advice, not you as a person. And this comment is an example of what seems to be a disconnect between your understood attack models and the attacks that people actually need to defend against.
- dessant 8y agoDiscord defends against combo lists by showing a CAPTCHA and asking for email confirmation if you log in from a new location, but no challenge is shown during the default login flow.