Re:Weak passwords brute forced
by muglug on Tuesday November 19, 2013 @11:02PM
(#6766218)
You can also force a timer on a per-account basis - e.g. twenty failed logins for one account from five different IP addresses -> set a timer on those IP addresses and a timer on that account. It's not simple, but it would help mitigate a mass-brute-force effort.
[ Parent
| on HN ]
Re:Weak passwords brute forced
by schrodinger on Tuesday November 19, 2013 @11:38PM
(#6766325)
But then it's trivial to lock someone out of their account by trying to login as them a bunch of times. That's why they'd key it based on ip and username, not ip alone.