@troyhunt had something good in mind. But it's worthless and worse, it might put a high cognitive burden on the user! (see @marcan42 impl.)pic.twitter.com/LgAIULN2CI
-
But asking some site that does not properly hash passwords to implement safe rate-limiting against a botnet is kind of nonsense. Much harder
-
-
No, no, I was talking about the paper
@m33x mentions: most policies are wrong, too much for online attacks but not enough for offline -
Also, that offline attacks are only useful in very narrow cases (hashed but breach unnoticed). I disagree with that
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.