4 ms·

So if I know a user's email I can lock their account by just triggering a reset password.

• ra 15y ago
  Yeah brute force lockout is a destructive attack. A better lock-out approach is to disable logins for a period of time (say 1 minute)... i.e. as someone said above, you don't want to destroy the old password in case the reset was requested by someone else.