Brute force protection

@memes

you are viewing a single comment's thread
view the rest of the comments
[–] 186 points 2 years ago (3 children)

It's not quite complete without code on the password reset page to tell you that you can't reuse your password.

  • source
  • hideshow 6 child comments
  • [–] 132 points 2 years ago (3 children)

    And label the text box "username" when it only accepts email address.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 62 points 2 years ago (2 children)

    Don't forget to have hidden password requirements and secretly truncate any password longer than 12 characters.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 32 points 2 years ago

    Well yeah, if you don’t truncate the password to 12 chars how will you fit the plaintext in a memory efficient fixed latin1 CHAR column that only accepts letters, numbers, and underscores

    /s

  • source
  • parent
  • [–] 13 points 2 years ago* (1 child)

    And then validate the email with a custom regex that definitely doesn’t account for all the valid syntax permutations defined by the several email-oriented RFCs

  • source
  • parent
  • hideshow 2 child comments
  • [–] 11 points 2 years ago

    I've had that before and I'm very confident the password was correct - my theory is that they'd changed how non-ASCII characters like £ were handled and their code only half recognised my password.

  • source
  • parent