3 ms·

I believe it's company / business level decision. 6 to 10 length numeric password is easy to remember. And non rate limiting enables older, non tech savvy users

I believe it's company / business level decision. 6 to 10 length numeric password is easy to remember. And non rate limiting enables older, non tech savvy users to have as many error as they want. But the password complexity, rate limiting and other security measurements are there for a reason, and whoever cannot learn from history are doomed to repeat it.

winsome 6y ago
Rate-limiting has nothing to do with the older, non-tech savvy users. You're thinking of maximum failed attempts. Rate-limiting is about preventing bots from spamming an API call.
- fendy3002 6y ago
  Oh correct, it's as you've said.