3 ms·

> Why wouldn't Instagram just allow a fixed number of tries (some low limit, like 25) from any IP before invalidating the code? This could makes it very easy t

> Why wouldn't Instagram just allow a fixed number of tries (some low limit, like 25) from any IP before invalidating the code? This could makes it very easy to perform a DOS attack against a user. You could constantly send failed attempts and make it impossible for the user to type in the real code before you invalidate it.

ummonk 7y ago
Add a captcha then.
- tylerhou 7y ago
  Still not hard to manually DOS. And to do it at scale you only have to pay 2.5 cents per invalidation.
  - merb 7y ago
    well you can't dos a user forever. and it's quite impossible that somebody knows that a user lost it's password and DOS's the reset mechanism.