Hacker News Reader

Call me naive. but I've never understood why it is so difficult to simply thwart brut-force attacks by setting limits on how many times a password can be entered. Wouldn't that simply defeat all efforts if, e.g., after 20 password attempts the account is locked and has to be manually unlocked through a human process or simply locked for a certain amount of time that would seriously thwart the effectiveness of additional attempts.

View on HN

Oh, they certainly do that. This is mostly about offline attacks where someone has stolen a database of usernames and password hashes, and if they figure out the passwords from the has they can access the account on that website (if they were undetected), and they can also hope that users have the same login/password combination on other websites.

However, if you're going to use a brute-force attack on a website the way to do it is to try a common password on every username you can think of, not every password on a single username. And a way to prevent them from simply blocking your IP address, like using a botnet.

From the comments:

> This isn't an online attack. Hashcat and variants work by attacking the password hashes after they've been leaked/stolen somehow. Not by attempting billions of logins per second over the Internet (if any server allowed that... someone needs to change careers).

Reply on news.ycombinator.com