Hacker News new | ask | show | jobs
by NicoJuicy 2368 days ago
Why an IP block instead of a username block
3 comments

Different attacks.

If you have a network, 1 IP could then try 1 time a user + password. Then switch to another device with a different IP for another one.

The first IP could then try a different user.

You need a combination, not one or the other.

And then, you have to deal with a university or other big institution and users forgetting their passwords after the holidays. That would potentially trigger a ban of everyone.

Username block is a denial of service against that user.
Because then I could block your access with minimal effort.