4 ms·

Yeah, I wrote about this a few years ago and got a lot of press for it. They didn't really fix it, but at least they started rate limiting by IP address. https:

• freditup 12y ago
  Is rate limiting by IP the best way to handle something like this (other than the obvious, allowing better passwords)? You could obviously rate limit by account, but then you make it easy for anyone to lock anyone else out of their account. And obviously rate limiting by cookies as mentioned is awful.
  • kevinburke 12y ago
    There's no great way to "handle" something like this besides modifying the protocol to be less vulnerable.