News for hackers. Stuff that matters.

A comment on Prevent users registering with passwords from data breaches. Parent comment

Re:Prevent users registering with passwords from data breaches by air7 on Saturday January 19, 2019 @07:43AM (#18946739)
> Aside, how do you implement account-locking without making it trivial for users to DoS each other that way?

By adding an (increasing) time delay after each failed attempt. However many sites, banking in particular, just lock your account and you have to call them on the phone to reopen it. Totally open for massive DoS but the world still stands.

[ Parent | on HN ]
Re:Prevent users registering with passwords from data breaches by hombre_fatal on Saturday January 19, 2019 @08:51AM (#18947028)
Well, that introduces trivial DoS, so it doesn't satisfy my question.

Notice that banking websites can get away with it, yet surely you weren't only talking about banking when you said "online attacks".

[ Parent | on HN ]
Re:Prevent users registering with passwords from data breaches by air7 on Saturday January 19, 2019 @11:30AM (#18947753)
Sorry, I tried to say 2 things: 1. Your simple solution: add a 5 second delay after each failed attempt per username OR ip address. 2. It seems that sites that do account lock-outs don't suffer from DOS attacks, for some reason.
[ Parent | on HN ]