The rate limit per IP cam be lower than per user to make this more difficult; you can also offer other options (captchas, less brute-forceable auth factors). N

The rate limit per IP cam be lower than per user to make this more difficult; you can also offer other options (captchas, less brute-forceable auth factors). Not sure your point on “resetting” passwords, though. This applies to any validation flow, i.e. just logging in.