Re:Recent 'MFA Bombing' Attacks Targeting Apple Users
by fortran77 on Wednesday March 27, 2024 @09:27AM
(#39838766)
Wow! You'd think they'd rate limit these! Once you've done it twice, go to once every 15 minutes, then hour, then 4 hours, than day, etc. Like bad logins.
[ Parent
| on HN ]
Re:Recent 'MFA Bombing' Attacks Targeting Apple Users
by nilsherzig on Wednesday March 27, 2024 @11:41AM
(#39840700)
That would allow me to log you out of your accounts
Re:Recent 'MFA Bombing' Attacks Targeting Apple Users
by prepend on Wednesday March 27, 2024 @12:55PM
(#39841603)
No, it would affect login status. Just a delay between reset attempts.
No reset actually occurs until one prompt is accepted.
Re:Recent 'MFA Bombing' Attacks Targeting Apple Users
by WorldMaker on Wednesday March 27, 2024 @01:41PM
(#39842242)
Krebs notes that the recovery form does have some form of CAPTCHA on them, which mostly just goes to show that CAPTCHA systems are a poor and increasingly deficient rate limiter.
ETA: Also from a user experience even once a week between attempts is still enough to deeply annoy a user getting popups on their devices. This is one of those cases where rate limits probably still can't solve the user irritation.