News for hackers. Stuff that matters.

A comment on Weak passwords brute forced. Parent comment

Re:Weak passwords brute forced by ye on Wednesday November 20, 2013 @09:54AM (#6768308)
Looks like they didn't rate-limit per-user, but only per-IP.

Now that is dumb. I expected more from GitHub.

[ Parent | on HN ]
Re:Weak passwords brute forced by gfxmonk on Wednesday November 20, 2013 @10:14PM (#6772840)
If they rate limited per user, you could trivially prevent someone from logging in by pummeling the server with login attempts for their username.
[ Parent | on HN ]
Re:Weak passwords brute forced by ye on Thursday November 21, 2013 @07:52AM (#6774420)
If there are limits per-user and per-IP, they would need a shit ton of IPs to do that to any reasonable number of users.
[ Parent | on HN ]