1018

Brute force protection (rytter.me)

submitted 6 months ago by anders@rytter.me to c/memes@lemmy.ml

111 comments fedilink hide all child comments

Brute force protection

@memes

you are viewing a single comment's thread
view the rest of the comments

[-] kryptonianCodeMonkey@lemmy.world 133 points 6 months ago

And label the text box "username" when it only accepts email address.

[-] helpImTrappedOnline@lemmy.world 64 points 6 months ago

Don't forget to have hidden password requirements and secretly truncate any password longer than 12 characters.

[-] kautau@lemmy.world 34 points 6 months ago

Well yeah, if you don’t truncate the password to 12 chars how will you fit the plaintext in a memory efficient fixed latin1 CHAR column that only accepts letters, numbers, and underscores

[-] Buddahriffic@lemmy.world 3 points 6 months ago

Battle.net used to not be case-sensitive for passwords, back in like the pre-wow era.

[-] helpImTrappedOnline@lemmy.world 1 points 6 months ago

Intresting. At least they got their act together, even making a physical totp authenticator in the 2000s.

[-] gravitas_deficiency@sh.itjust.works 13 points 6 months ago* (last edited 6 months ago)

And then validate the email with a custom regex that definitely doesn’t account for all the valid syntax permutations defined by the several email-oriented RFCs

[-] MoonMelon@lemmy.ml 3 points 6 months ago

Only on mobile though, on desktop have different criteria. Perhaps give the text box an arbitrary max length of like 30 characters on sign-in but not on account creation.