4 ms·
The number of accounts compromised (or really, the number of times an account is compromised) has to be put in context. The context is the number of logins per
by prophetjohn 15y ago
The number of accounts compromised (or really, the number of times an account is compromised) has to be put in context. The context is the number of logins per unit time. So, I think they're both important.
And I don't think anyone is saying that any number of compromised accounts is a good thing. I question how much control Facebook has, though, given that many people will inevitably have passwords such as "abcd1234."
- Retric 15y agoI agree you need context, but login's is only meaningful logging in where to compromise an account. If the issue is brute forcing passwords then time is the only meaningful context. As to passwords, it's easy enough to prevent overly common passwords just prevent someone from using overly easy to guess passwords, and throttling failed loggins for a given act to 20 / hour per IP makes dictionary attacks all but useless anyone without a bot net.