Hacker News Reader

I suppose if you see repeated failures across a range of IP addresses you could temporarily block the entire account and send a reactivation email to the registered email address.

That would prevent a practical joker at work from locking you out unless he went to a lot of extra trouble.

View on HN

At some point I'm starting to see the appeal of completely abandoning passwords in favour of email or SMS-based token creation.

You attempt a login, they send an out-of-band request for confirmation. You do the confirm, and they let you in. Like a superfast streamlined version of the "reset password" email.

The existing 2 factor auth basically does this, without the requirement of SMS, internet, or any connectivity really in general. The OTP tokens are based on time or a counter, and a secret key.

Considering Github is frequently the target of DDoS attacks, I would assume there are people willing to go to a fair bit of trouble to lock you out of your account.

Reply on news.ycombinator.com