3 ms·
> a well-designed password (or similar) validation endpoint will both limit attempts per IP and per user I hope you‘ll never have to reset your password then a
by axiosgunnar 5y ago
> a well-designed password (or similar) validation endpoint will both limit attempts per IP and per user
I hope you‘ll never have to reset your password then as I‘ll happily send out those 5 requests every hour to lock you out ;-)
This is also a kind of attack.
- md_ 5y agoThe rate limit per IP cam be lower than per user to make this more difficult; you can also offer other options (captchas, less brute-forceable auth factors). Not sure your point on “resetting” passwords, though. This applies to any validation flow, i.e. just logging in.