Weak passwords brute forced

Re:Weak passwords brute forced by ams6110 on Tuesday November 19, 2013 @10:48PM (#6766172)

I suppose if you see repeated failures across a range of IP addresses you could temporarily block the entire account and send a reactivation email to the registered email address.

That would prevent a practical joker at work from locking you out unless he went to a lot of extra trouble.

[ Parent | on HN ]

Re:Weak passwords brute forced by Pxtl on Tuesday November 19, 2013 @10:51PM (#6766186)

At some point I'm starting to see the appeal of completely abandoning passwords in favour of email or SMS-based token creation.

You attempt a login, they send an out-of-band request for confirmation. You do the confirm, and they let you in. Like a superfast streamlined version of the "reset password" email.

[ Parent | on HN ]

Re:Weak passwords brute forced by oomkiller on Tuesday November 19, 2013 @10:58PM (#6766202)

The existing 2 factor auth basically does this, without the requirement of SMS, internet, or any connectivity really in general. The OTP tokens are based on time or a counter, and a secret key.

[ Parent | on HN ]

Re:Weak passwords brute forced by eli on Tuesday November 19, 2013 @10:51PM (#6766183)

Considering Github is frequently the target of DDoS attacks, I would assume there are people willing to go to a fair bit of trouble to lock you out of your account.

[ Parent | on HN ]