2 ms·
False negatives are a thing. If they've got a 99.9% success rate at blocking password attacks, it means there's 7 qps of successes. That's 500k hijacked account
by jsnell 2y ago
False negatives are a thing. If they've got a 99.9% success rate at blocking password attacks, it means there's 7 qps of successes. That's 500k hijacked accounts per day, 200M per year. That is a very large number.
And not a lot of systems have 99.9% recall, without trading away absurd amounts of precision...
- kazinator 2y agoIf they suspend an account after, say, 20 password attempts, they're success rate at stopping password guessing will be vanishingly close to 100%. Especially if they've instigated strong passwords. If passwords cannot contain dictionary words and must be mixed case with at least one special character in digit, there's no freaking way anybody's going to guess their way in, with a small number of tries before the account is frozen. The number of penetrations from that is going to be so tiny, it's not worth worrying about. The bigger worry are stolen password hashes being cracked surreptitiously, where the attacker has an unlimited number of tries whose rate is only limited by their hardware.