Subject: Re: User to get locked after three wrong login attempts.
To: pgsql-admin@lists.postgresql.org
References: 
 <CAHnVB4C9tSJkD4Ysd645HJmJjWzNYKJgUumE74YY8FRjUFJE4g@mail.gmail.com>
 <30655.1536069964@sss.pgh.pa.us> <20180905174832.GO4184@tamriel.snowman.net>
 <87va7j61g2.fsf@gmail.com>
 <CAFwQ8rerOUEptWfbtrVusBTMqsEcTqDbnN6Q+O+o-49mmTUPqw@mail.gmail.com>
From: Ron <ronljohnsonjr@gmail.com>
Message-ID: <1ea8bec3-1d0b-b69f-cbc0-c936860696f4@gmail.com>
Date: Wed, 5 Sep 2018 17:18:38 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
 Thunderbird/52.9.1
MIME-Version: 1.0
In-Reply-To: 
 <CAFwQ8rerOUEptWfbtrVusBTMqsEcTqDbnN6Q+O+o-49mmTUPqw@mail.gmail.com>
Content-Type: multipart/alternative;
 boundary="------------35F139995AFF746E41EA9453"
Content-Language: en-US
Precedence: bulk

This is a multi-part message in MIME format.
--------------35F139995AFF746E41EA9453
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit

On 09/05/2018 05:14 PM, Craig James wrote:
[snip]
> To elaborate, you should explain to the auditor that this introduces a 
> huge denial-of-service vulnerability into your system. Anyone can start 
> hammering on everyone else's accounts, and with a fairly trivial script, 
> lock the entire company out of all accounts. This is a terrible idea.

And be tracked down (relatively) quickly.

-- 
Angular momentum makes the world go 'round.

--------------35F139995AFF746E41EA9453
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 7bit

<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    On 09/05/2018 05:14 PM, Craig James wrote:<br>
    [snip]<br>
    <blockquote type="cite"
cite="mid:CAFwQ8rerOUEptWfbtrVusBTMqsEcTqDbnN6Q+O+o-49mmTUPqw@mail.gmail.com">
      <div dir="ltr">
        <div class="gmail_extra">
          <div class="gmail_quote">
            <div>To elaborate, you should explain to the auditor that
              this introduces a huge denial-of-service vulnerability
              into your system. Anyone can start hammering on everyone
              else's accounts, and with a fairly trivial script, lock
              the entire company out of all accounts. This is a terrible
              idea.</div>
          </div>
        </div>
      </div>
    </blockquote>
    <br>
    And be tracked down (relatively) quickly.<br>
    <br>
    <div class="moz-signature">-- <br>
      Angular momentum makes the world go 'round.</div>
  </body>
</html>

--------------35F139995AFF746E41EA9453--