News for hackers. Stuff that matters.

A comment on Weak passwords brute forced. Parent comment

Re:Weak passwords brute forced by ajtaylor on Tuesday November 19, 2013 @10:29PM (#6766111)
The article did mention the use of 40k unique IP addresses, so I'm guessing their rate limiting is based on IP address and not the username or IP+username combination.
[ Parent | on HN ]
Re:Weak passwords brute forced by X-Istence on Tuesday November 19, 2013 @10:58PM (#6766203)
Why not both?
[ Parent | on HN ]
Re:Weak passwords brute forced by fragsworth on Wednesday November 20, 2013 @01:12AM (#6766581)
Maybe they're doing this now that it's a real problem?

At any rate, don't store really sensitive stuff on Github. It's a bad idea for many reasons, security flaws being one. In particular, keep in mind things like AWS server credentials which might go in your repository.

[ Parent | on HN ]
Re:Weak passwords brute forced by rythie on Wednesday November 20, 2013 @03:06AM (#6766878)
Doing it by username means the real user can lose access to their account, whilst it is being attacked, even though they might have strong password.
[ Parent | on HN ]