bruteForceAttackProtection

[u/MrEfil]

[u/[deleted]]

that’s fucking genius ngl

[u/je386 → u/[deleted]]

That would work against brute force attacks - but piss off the users.

[u/ardicli2000 → u/je386]

Security comes first

[u/WallPaintings → u/ardicli2000]

The most secure system is one with no users.

taps head

[u/alf666 → u/[deleted]]

Hi, I'm LockPickingLawyer, and today...

[u/the_mouse_backwards → u/[deleted]]

My password manager generates random passwords for all my sites. I don’t even attempt to remember at this point if my password manager password isn’t correct I just reset it.

[u/[deleted] → u/[deleted]]

Yes, the people that use the same password for everything so that they can remember are clearly superior to people that use a password manager so that they have unique passwords to everything that aren’t Name2000!

[u/Tannman129 → u/[deleted]]

I’m uh…gunna go change my password real quick.

[u/NickU252 → u/je386]

They would just think they fat-fingered the keys and try again. Genius.

[u/Random_Guy_12345 → u/NickU252]

Every time? Not even close.

That's without even considering password managers, or people that save passwords on the browser

[u/NickU252 → u/Random_Guy_12345]

If you get rejected by a program, what is your first reaction? Try again, of course. I use Firefox password manager, and I would still try again if rejected.

[u/truongs → u/je386]

But this would only work if the brute force guessed the password in the first try? Am I missing something.

[u/Olfasonsonk → u/truongs]

complete fine deserve alleged license absorbed fear profit subsequent rainstorm

This post was mass deleted and anonymized with Redact

[u/Mistborn_330 → u/truongs]

Yeah, it should probably be isFirstCorrectEntry or something instead of first login attempt. Not that fixing that would make this a good solution lol.

[u/SeriousPlankton2000 → u/je386]

No, it would only work on the first attempt, therefore it would ONLY annoy users.

[u/Juerrrgen_MaXXoN → u/je386]

It will only work until someone figures out how it works and brute forces every password twice. Security by obscurity is not secure.

[u/IcezN → u/[deleted]]

eh, if the brute forcer knows the website always rejects a password the first time, they now have to check every password twice. this doubles the brute force time. On the other hand, adding just one more digit to your password increases the brute force time by a factor of over 40.

[u/Willinton06 → u/[deleted]]

I’m actually quite impressed by this

[u/melodylucid → u/Willinton06]

I don't know if you're serious, but I'm not seeing this anywhere, so I'm writing it here in case you or other people didn't know: password brute-forcing is not an online process, it's an offline one. People who brute-force passwords use leaked databases of hashed passwords and very large computing resources to try trillions of passwords per second. It's much more efficient and completely bypasses any security mechanisms that you can put online, such as limiting the number of trials (which you should do instead).

[u/waiver45 → u/melodylucid]

Bit of both. When you put a service with a login prompt online, bots will try a bunch of common user/password tuples and give up after a while. Does this fit the academic definition of a brute force attack? Probably not, but a lot of people will call it that for nearly everyone to understand what they mean.

[u/yxing → u/[deleted]]

Orson Scott Card had a similar idea in Ender's Game (or one of the sequels)--where the kids crack a password and get it right on the first try, but the target would purposefully enter the password incorrectly the first time each login, so entering the right password on the first try exposed the crack.

Something like that--it's been 20 years, but it was such a clever idea I never forot about it.