3 ms·
Why wouldn’t exponential API rate limiting not solve this brute force issue?
by sockaddr 4y ago
Why wouldn’t exponential API rate limiting not solve this brute force issue?
- the_third_wave 4y agoBecause brute force does not imply a high rate. You can brute force a password by making attempts on an irregular schedule, a few attempts per hour. That will not be caught by any rate limiter as it would make the service unusable for regular users with fat fingers or misconfigured keyboards.