3 ms·
Isn't this discussion premised on a server configured to allow fast password guessing indefinitely? This is 2011, shouldn't every server be configured to allow
by marze 15y ago
Isn't this discussion premised on a server configured to allow fast password guessing indefinitely?
This is 2011, shouldn't every server be configured to allow a guess every two seconds for 20 guesses, then every 10 minutes, or something similar?
I'm not familiar with common practices in this area, but why wouldn't all such services be configured to limit the incorrect guesses?
- ry0ohki 15y agoMost really strong systems lock an account after a couple of incorrect guesses. I assume this is all for systems that may not be secured to prevent brute force.
- mtogo 15y agoLocking the account is the wrong way to go about it since it makes DoS on known accounts trivial. Blocking the IP or an increasing time between tries is, afaik, the "right way".