3 ms·
> You need to have some protection against brute-forcing. Yes, that protection is called "password". > Whether it's limiting the rate of guessing or whatever,
by zAy0LfpBZLC8mAC 7y ago
> You need to have some protection against brute-forcing.
Yes, that protection is called "password".
> Whether it's limiting the rate of guessing or whatever, the attacker is still "modifying the state of a system."
Which is why you should not limit the rate of guessing (or at least offer that option--limiting the rate of guessing does help users who use terrible passwords, after all).
> Indeed, that's a weird rule. When someone stole my credit card number and ran up charges, my bank called me to verify them. How was that not "modifying the state of a system?"
Which is exactly why that shouldn't be a thing. Being able to pay with a semi-public number is just stupid. You should have to authenticate using a strong password, and "stealing credit card numbers" simply wouldn't be a thing anymore.
- SamBam 7y ago> Yes, that protection is called "password". [...] Which is why you should not limit the rate of guessing Any password can be brute-forced if you neither limit the number of guesses nor limit the rate that you can guess them.
- zAy0LfpBZLC8mAC 7y agoNo, it can't. If you are willing to say that a cow can not jump over the moon, then a strong password can not be brute-forced, even though it might theoretically be possible for a cow to quantum-tunnel over the moon, and it might theoretically be possible that an attacker guesses your password. The probability is so vanishingly small that you would call it impossible in any other context.