3 ms·
Rate limit the requests. Do an account lockout with an email click to re-enable after 10 guesses, do 2FA on new devices and you get pretty good security. For m
by tempnow987 5y ago
Rate limit the requests. Do an account lockout with an email click to re-enable after 10 guesses, do 2FA on new devices and you get pretty good security.
For many systems, users can memorize 6 digits easily.
The reality is, whatever your password reset flow is is enough. If you can reset your password with a 6 digit number via text, then that is maximum needed for actual password as well in most cases.
- marcosdumay 5y agoNone of that will help you if your hash database leaks. But I'm ok with letting the decision with the user.
- tempnow987 5y agoInteresting. In most cases if hash database leaks, the ability to crack depends on two factors, not one (password and hash difficulty) assuming you are salting properly. You can specify pretty high difficulty with argon2id etc. Ie, shoot for a one second runtime with a very high memory requirement (you can go to GB range even). So I'm not sure all is always necessarily lost