> Unless otherwise specified in the description of a given authenticator, the verifier SHALL effectively limit online attackers to 100 consecutive failed attempts on a single

I think that can be read two ways.

1) 100 failed attempts/account/month 2) 100 failed attempts/IP/account/month

The latter still limits an attacker but is less likely to be a plausible DoS against the account unless the attacker has compromised the legitimate user's machine at which point all is lost anyway. Later in the same section:

> When the subscriber successfully authenticates, the verifier SHOULD disregard any previous failed attempts from the same IP address.

Which suggests the failure count is per IP and not per account.