News for hackers. Stuff that matters.

A comment on New NIST password guidelines: don't require character types or rotation. Parent comment

Re:New NIST password guidelines: don't require character typ... by eli on Wednesday December 14, 2016 @06:44AM (#13175294)
Bad guys can easily rent time on botnets with hundreds of thousands of ips.
[ Parent | on HN ]
Re:New NIST password guidelines: don't require character typ... by henvic on Wednesday December 14, 2016 @10:15AM (#13176503)
So the solution for you seems to be allowing bad guys DoS your system because bad guys can do bad things, is it?
[ Parent | on HN ]
Re:New NIST password guidelines: don't require character typ... by jessaustin on Wednesday December 14, 2016 @01:33PM (#13178395)
Is per-IP rate limiting the only one way to respond to auth DoS? Different situations involve different trade-offs.
[ Parent | on HN ]
Re:New NIST password guidelines: don't require character typ... by eli on Wednesday December 14, 2016 @02:18PM (#13178835)
Rate limiting. Not denying service. Bad guys could cause you to have to wait some number of seconds to log in.
[ Parent | on HN ]