Timeline for Why do sites implement locking after three failed password attempts?
Current License: CC BY-SA 2.5
2 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 19, 2010 at 13:39 | comment | added | Bradley Kreider | Great points. It doesn't even have to be that sophisticated. They could do the breadth first attack and a spaced out weeks long attack. But the delays do give you a known maximum rate of attack though (if you disregard source IP). If you lock the account after 10000 (any high number) failures in a row, you trade a DoS (if the administrator doesn't pay attention) for getting cracked (assuming 2 factor is out of reach). | |
| Nov 19, 2010 at 13:31 | history | answered | Dan McGrath | CC BY-SA 2.5 |