Hacker News Reader

> Rate limiting on a specific username will prevent brute forcing but exposes you to DOS.

Why?

Not the OP, but I think he's referring to the potential for an automated service spamming thousands (or more) accounts enough to lock them.

You can lock a user out of their account by spamming the server with login attempts.

Yes. In this case the denial of service is against specific customer accounts for the lockout duration, not against the availability of the site.

This would be bad, but what's the motivation? What fabulous prizes await the DOSer of some random account on your service?

Locking users out of their accounts isn’t the goal, it’s just an unfortunate side effect.