News for hackers. Stuff that matters.

A comment on Prevent users registering with passwords from data breaches. Parent comment

Re:Prevent users registering with passwords from data breaches by hombre_fatal on Saturday January 19, 2019 @08:51AM (#18947028)
Well, that introduces trivial DoS, so it doesn't satisfy my question.

Notice that banking websites can get away with it, yet surely you weren't only talking about banking when you said "online attacks".

[ Parent | on HN ]
Re:Prevent users registering with passwords from data breaches by air7 on Saturday January 19, 2019 @11:30AM (#18947753)
Sorry, I tried to say 2 things: 1. Your simple solution: add a 5 second delay after each failed attempt per username OR ip address. 2. It seems that sites that do account lock-outs don't suffer from DOS attacks, for some reason.
[ Parent | on HN ]