[C7H8N4O2]

> Rate limiting on a specific username will prevent brute forcing but exposes you to DOS.

Why?

[bluesroo]

Not the OP, but I think he's referring to the potential for an automated service spamming thousands (or more) accounts enough to lock them.

[Sohcahtoa82]

You can lock a user out of their account by spamming the server with login attempts.

[jsmeaton]

Yes. In this case the denial of service is against specific customer accounts for the lockout duration, not against the availability of the site.

[jessaustin]

This would be bad, but what's the motivation? What fabulous prizes await the DOSer of some random account on your service?

[jsmeaton]

Locking users out of their accounts isn’t the goal, it’s just an unfortunate side effect.