> You need to have some protection against brute-forcing. Whether it's limiting the rate of guessing or whatever, the attacker is still "modifying the state of

> You need to have some protection against brute-forcing. Whether it's limiting the rate of guessing or whatever, the attacker is still "modifying the state of a system." You could just make brute-force searches unproductive, for example by requiring a hardware security key or client certificate rather than a mere password or PIN. Good luck brute-forcing a 128+-bit random secret. > When someone stole my credit card number and ran up charges, my bank called me to verify them. How was that not "modifying the state of a system?" The state of the system was modified when an unauthenticated (never mind unauthorized) individual managed to run up charges on your account using only your credit-card number—which is "sensitive" information but not actually secret. That should not have been permitted in the first place. If the rule had been applied properly then this remedial step would not have been necessary.