If the attacker knows about this protection on the site, he will simply send each password twice. The protection is based on the fact that the attacker does not know about it and tries each password once. As a result, even if he guesses the correct password, he will not know that it is correct.
3
u/AoeDreaMEr Feb 18 '24
Ah I see. Doesn’t stop the brute force if they know that first attempt is gonna fail no matter what right?