3 ms·

Even if it’s encrypted, they could send both forms. Edit: not a good idea.

• squeaky-clean 5y ago
  I'm no security expert, but this would let someone try two unrelated passwords at once and so probably wouldn't be done client-side.
  • the_gipsy 5y ago
    Ouch, you are right.
  • iso1210 5y ago
    In practice is there really any difference between allowing a client to try 10 passwords before 'lock out' (say no more attempts for 10 minutes), or try 5 passwords before hand.