3 ms·

If google allows strong passwords such as "Password1" then I'm sure quite a few users would pick such a simple password, and I'm sure attackers realise this. I

by tarkin2 18y ago

If google allows strong passwords such as "Password1" then I'm sure quite a few users would pick such a simple password, and I'm sure attackers realise this. It would be wise if google forced the user to enter the capcha on password change. Disallowing GET would be good as well. Otherwise attackers would would have to use POST, which would mean tricking the user to submit a html form, and I'm unsure if you can send multiple POST requests per submit.

tptacek 18y ago
There are plenty of direct ways to grind GMail passwords. I don't see what difference this silly attack makes.
- eli 18y ago
  The direct ways of guessing the password run into rate limiting -- it starts prompting for a CAPTCHA after X failed guesses. That's all this attack avoids.