Hacker News Reader

Doesn't this open up the opportunity to basically DOS someone from logging in to their own account?

If HN did this, I could theoretically have a ton of bots attempt to log in to your account, thus pushing your login timer ever higher, and making your login attempt fairly frustrating and slow.

View on HN

Yes, it is.

so you can simply have a maximum delay, of say 10 minutes.

If you had to wait 10 minutes to login to a website every time, you'd very quickly stop bothering to log in.

You'd rule out all the legitimate users and only be left with people trying to break in. That strategy would only work on a honey-pot site.

10 minutes +1ms vs 10minutes +2ms can still leak information.

Ideally you want something like 3 seconds per password per IP starting the timer before you look up the password.

Reply on news.ycombinator.com