Ever want to annoy the hell out of someone? Try their username or email a bunch of times and lock them out of their accounts. Bonus points if it's one of those super duper ultra secure banks that does password resets via snail mail.
/s [I don't condone doxing anyone. My point is that an attacker should not be able to modify the state of a system he's unauthorized to access]
Indeed, that's a weird rule. When someone stole my credit card number and ran up charges, my bank called me to verify them. How was that not "modifying the state of a system?"
You could just make brute-force searches unproductive, for example by requiring a hardware security key or client certificate rather than a mere password or PIN. Good luck brute-forcing a 128+-bit random secret.
> When someone stole my credit card number and ran up charges, my bank called me to verify them. How was that not "modifying the state of a system?"
The state of the system was modified when an unauthenticated (never mind unauthorized) individual managed to run up charges on your account using only your credit-card number—which is "sensitive" information but not actually secret. That should not have been permitted in the first place. If the rule had been applied properly then this remedial step would not have been necessary.
Yes, that protection is called "password".
> Whether it's limiting the rate of guessing or whatever, the attacker is still "modifying the state of a system."
Which is why you should not limit the rate of guessing (or at least offer that option--limiting the rate of guessing does help users who use terrible passwords, after all).
> Indeed, that's a weird rule. When someone stole my credit card number and ran up charges, my bank called me to verify them. How was that not "modifying the state of a system?"
Which is exactly why that shouldn't be a thing. Being able to pay with a semi-public number is just stupid. You should have to authenticate using a strong password, and "stealing credit card numbers" simply wouldn't be a thing anymore.
Any password can be brute-forced if you neither limit the number of guesses nor limit the rate that you can guess them.
Why doesn't a purchase require a password, at the very minimum?
Then, strangely, various senior folks found their accounts getting locked 1-2 times a day, including the founder. That autolock policy died in a week, and they started looking for 2FA failures instead, as they should have.
I had considered "accidentally" setting up a ssh loop to do this but never quite got around to it. I assume somebody else did. I doubt that an infusion of sanity happened by accident.
Typed in his email address in front of him, hit enter three times, locked him out. Since this was a military base, typed in the commanding officer's email address, started to do the same thing, and suddenly the sysadmin saw the light shine down from heaven.