News for hackers. Stuff that matters.

A comment on New NIST password guidelines: don't require character types or rotation. Parent comment

Re:New NIST password guidelines: don't require character typ... by semi-extrinsic on Wednesday December 14, 2016 @04:28AM (#13174789)
> This is prone to a DoS attack.

When will we see the first organization (government or private) that is effectively completely DoS'ed for days on end because their login does this, while all their email addresses are listed on their website? If sustained, I imagine this could shut down an entire organization quite effectively for a few days. Probably could lose someone millions. Or add insult to injury, and have them pay BTC for the attack to stop.

[ Parent | on HN ]
Re:New NIST password guidelines: don't require character typ... by henvic on Wednesday December 14, 2016 @02:14PM (#13178806)
Sometimes I definitely scare my coworkers just by caring about such edge cases. They probably think I use foil hat at home :)
[ Parent | on HN ]
Re:New NIST password guidelines: don't require character typ... by jessaustin on Wednesday December 14, 2016 @01:18PM (#13178257)
Such an organization might investigate the use of stored tokens so that all users don't have to be authenticated simultaneously.
[ Parent | on HN ]