Tell HN: In NSW, if Google doesn't track you, you can't pay Public School fees

Re:Tell HN: In NSW, if Google doesn't track you, you can't p... by JeanMarcS on Thursday December 06, 2018 @08:10AM (#18617692)

Isn’t it a bit lazy on the developers side ?

Limiting the number of errors before sending a link to reset your password (for example, I agree there might be different ways to deal with that) is no rocket science, and being dependent on third party for such a trivial thing is, in my opinion, a bad idea.

[ Parent | on HN ]

Re:Tell HN: In NSW, if Google doesn't track you, you can't p... by dmurray on Thursday December 06, 2018 @08:55AM (#18618028)

It really isn't trivial. Rate limiting is great, but not enough. If you lock people out after a certain number of failed login attempts, you allow an adversary to DOS your users by constantly trying to log in as them.

[ Parent | on HN ]

Re:Tell HN: In NSW, if Google doesn't track you, you can't p... by dpwm on Thursday December 06, 2018 @06:16PM (#18623471)

> It really isn't trivial. Rate limiting is great, but not enough.

Rate limiting alone isn't a solution. But it can be part of a solution that doesn't require reCAPTCHA.

> If you lock people out after a certain number of failed login attempts, you allow an adversary to DOS your users by constantly trying to log in as them.

That isn't how the pattern works. On next successful login you basically inform the user that they need to confirm it's them with an email token. It works well. ReCAPTCHA doesn't.

[ Parent | on HN ]