2 ms·
> and one where the password lockout system meant that you could DDoS all admin access trivially What happened there?
by Capricorn2481 6mo ago
> and one where the password lockout system meant that you could DDoS all admin access trivially
What happened there?
- SahAssar 6mo agoPassword attempt lockouts where not scoped to anything besides the account itself. By just spamming a few attempts per account you could lock all admin accounts meaning that there was no admin to unlock the other accounts. The only solution in such a case would be to manually remove the lockout flags in the db.