Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

If the attacker doesn't care which account they break into, they could try a different account each time and then account-based rate limiting doesn't help as much.

(Depending on how many accounts there are that they can try.)



Hopefully they aren't able to get a list of all your user accounts. The IDs should not be iterable (like a UUID, for example!), and the friendly name (like an email address) is private information that shouldn't be getting out.


Generally, the subject tokens (short-ish, human enterable tokens) should only be active on a fraction of your accounts at any one time.




Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: