4 ms·
If the attacker doesn't care which account they break into, they could try a different account each time and then account-based rate limiting doesn't help as mu
by skybrian 4y ago
If the attacker doesn't care which account they break into, they could try a different account each time and then account-based rate limiting doesn't help as much.
(Depending on how many accounts there are that they can try.)
- SkyPuncher 4y agoGenerally, the subject tokens (short-ish, human enterable tokens) should only be active on a fraction of your accounts at any one time.
- pkulak 4y agoHopefully they aren't able to get a list of all your user accounts. The IDs should not be iterable (like a UUID, for example!), and the friendly name (like an email address) is private information that shouldn't be getting out.