4 ms·
Nothing ultimately stops that but I am hoping a per-IP approach to lockouts will relieve my bona fide users from needing to go through a tedious reset process (
by timf 18y ago
Nothing ultimately stops that but I am hoping a per-IP approach to lockouts will relieve my bona fide users from needing to go through a tedious reset process (potentially often).
If you backoff to 5 minutes max per IP that leaves 288 tries a day per IP (well, slightly more because of the part where it backs off). With eight character minimum passwords, someone with a botnet would have to have probably thousands and thousands of unique IPs at their disposable to even being successfully brute forcing...?
- randallsquared 18y agoThe existence of botnets does complicate matters, though, as you note. In general, I don't agree that this is a matter for site designers; the more we try to protect the users from themselves, the more it will be our liability when we ultimately fail (and we will fail in the end).