4 ms·
> Until the users logs in, then you have another two tries. Until the users logs in, then you have another two tries. Well, and so on, ad infinitum. I don't un
by vonmoltke 7y ago
> Until the users logs in, then you have another two tries. Until the users logs in, then you have another two tries. Well, and so on, ad infinitum.
I don't understand how this is exploitable unless an attacker knows when a user logs in. Otherwise, how do they know when they have two tries again?
- zAy0LfpBZLC8mAC 7y agoWell, how about the attacker knows when the user logs in, then? That's not exactly sensitive information ... or at least it shouldn't be. There sure are plenty of ways of how that info could leak out. But also, an attacker might just not care? Just try to get into a vast number of accounts at a rate that generally, statistically, doesn't trigger lockout, and it might just be irrelevant that that triggers some lockouts here and there.