Re:How To Safely Store A Password
by Raphael on Tuesday December 14, 2010 @09:14PM
(#2006739)
I think rate limiting per user is perfect. And if the real person wants to log in while someone else used up their attempts, do a quick email confirmation.
[ Parent
| on HN ]
"do a quick email confirmation". And what happens if one or more of your users gets targeted for a long period of time ? You will force them to open there inbox every time they want to log in your site ? And this gets even better if they target your site generaly, it will be a lot of fun for the majority of your userbase to have to do that "open inbox" step, bet users will love it :)
Sorry mate but your method sounds easily exploitable ... heck using reCaptcha would be less punishing for the user than your approach.