<story><title>Weak passwords brute forced</title><url>https://github.com/blog/1698-weak-passwords-brute-forced</url></story><parent_chain><item><author>forrestthewoods</author><text>How is this possible? I would expect repeated failed login attempts would force a timer making a brute force attack impossible? Or at least more difficult. Is that not the case or am I missing a key piece of info? (Serious question, not trying to troll or be smug.)</text></item></parent_chain><comment><author>pavs</author><text>From the blog post:&lt;p&gt;&amp;quot;While we aggressively rate-limit login attempts and passwords are stored properly, this incident has involved the use of nearly 40K unique IP addresses. These addresses were used to slowly brute force weak passwords or passwords used on multiple sites. We are working on additional rate-limiting measures to address this. &amp;quot;</text></comment>
<story><title>Weak passwords brute forced</title><url>https://github.com/blog/1698-weak-passwords-brute-forced</url></story><parent_chain><item><author>forrestthewoods</author><text>How is this possible? I would expect repeated failed login attempts would force a timer making a brute force attack impossible? Or at least more difficult. Is that not the case or am I missing a key piece of info? (Serious question, not trying to troll or be smug.)</text></item></parent_chain><comment><author>ajtaylor</author><text>The article did mention the use of 40k unique IP addresses, so I&amp;#x27;m guessing their rate limiting is based on IP address and not the username or IP+username combination.</text></comment>