> If a user overrides a lockout and gets a new password, what is to stop the lockout process from starting over again as the attackers continue trying. The fac

> If a user overrides a lockout and gets a new password, what is to stop the lockout process from starting over again as the attackers continue trying. The fact that the password reset changes the password. So the brute-force attack would need to start over to be 100% successful. With the rate-limiting, and the user being forced to change the password via password reset, a brute-force attack becomes near impossible. At least that's how I understood it?