News for hackers. Stuff that matters.

A comment on New NIST password guidelines: don't require character types or rotation. Parent comment

Re:New NIST password guidelines: don't require character typ... by Loggie on Wednesday December 14, 2016 @09:26AM (#13176116)
Surely DOS would only be an issue if the service literally sat there doing nothing for that period of time? Isn't the solution here just to reject all requests for that period of time doing the absolute minimum processing required?
[ Parent | on HN ]
Re:New NIST password guidelines: don't require character typ... by detaro on Wednesday December 14, 2016 @09:28AM (#13176127)
Not DOS against the entire service, against a targeted user not being able to access the server (because you just entered a wrong password often enough that the system blocks his valid log-in attempts).
[ Parent | on HN ]