Pwned Passwords in Practice: Real World Examples of Blocking the Worst Passwords

Re:Pwned Passwords in Practice: Real World Examples of Block... by Sohcahtoa82 on Tuesday May 29, 2018 @03:19PM (#17182163)

You can lock a user out of their account by spamming the server with login attempts.

[ Parent | on HN ]

Re:Pwned Passwords in Practice: Real World Examples of Block... by jsmeaton on Tuesday May 29, 2018 @05:37PM (#17183097)

Yes. In this case the denial of service is against specific customer accounts for the lockout duration, not against the availability of the site.

[ Parent | on HN ]

Re:Pwned Passwords in Practice: Real World Examples of Block... by jessaustin on Tuesday May 29, 2018 @08:58PM (#17184088)

This would be bad, but what's the motivation? What fabulous prizes await the DOSer of some random account on your service?

[ Parent | on HN ]

Re:Pwned Passwords in Practice: Real World Examples of Block... by jsmeaton on Monday June 04, 2018 @01:03AM (#17224804)

Locking users out of their accounts isn’t the goal, it’s just an unfortunate side effect.

[ Parent | on HN ]