3 ms·
> By the account. 3 failed login attempts in a row, and you disallow further logins for 30 seconds. ...congratulations, I just locked out all of your users. Ha
by LaGrange 7y ago
> By the account. 3 failed login attempts in a row, and you disallow further logins for 30 seconds.
...congratulations, I just locked out all of your users. Have a nice day.
- Kaiyou 7y agoHow did you get the email addresses of all my users, which are used as login name?
- LaGrange 7y agoFrom that messed up email from support that leaked them. Or I assumed that you'll have a big cross-section with some other site that leaked. This is not theory, this is hard-earned experience. Locking-out people is bad, the most that's acceptable is rate limiting to a once every few seconds.