> Oops, the user entered their email as [email protected] instead of [email protected]? Or [email protected] instead of [email protected]? ... > when present

> Oops, the user entered their email as [email protected] instead of [email protected]? Or [email protected] instead of [email protected]? ... > when presented with a login dialog, like to rapidly type > [email protected], tab, p4$$w0rd, enter ... So... Tell me. Considering that you don't block people finding out email addresses on Discourse in the interests of user-friendliness, why on earth are you blocking email addresses, and ones for the purpose of examples at that? An interesting juxtaposition there, and rather ironic, to put it mildly. Also: > I think a nice middle ground is to insert standard pauses of moderately increasing size after repeated sequential failures or repeated sequential forgot password requests from the same IP address. So that's what we do. So what about NATs? There are countries with one public IP address.