<instructions>Your goal is to analyze the following comment and estimate how highly it will be upvoted by the Hacker News community.</instructions><comment><author>pavs</author><text>From the blog post:&lt;p&gt;&amp;quot;While we aggressively rate-limit login attempts and passwords are stored properly, this incident has involved the use of nearly 40K unique IP addresses. These addresses were used to slowly brute force weak passwords or passwords used on multiple sites. We are working on additional rate-limiting measures to address this. &amp;quot;</text><parent_chain><item><author>forrestthewoods</author><text>How is this possible? I would expect repeated failed login attempts would force a timer making a brute force attack impossible? Or at least more difficult. Is that not the case or am I missing a key piece of info? (Serious question, not trying to troll or be smug.)</text></item></parent_chain></comment><story><title>Weak passwords brute forced</title><url>https://github.com/blog/1698-weak-passwords-brute-forced</url></story>
<instructions>Your goal is to analyze the following comment and estimate how highly it will be upvoted by the Hacker News community.</instructions><comment><author>ajtaylor</author><text>The article did mention the use of 40k unique IP addresses, so I&amp;#x27;m guessing their rate limiting is based on IP address and not the username or IP+username combination.</text><parent_chain><item><author>forrestthewoods</author><text>How is this possible? I would expect repeated failed login attempts would force a timer making a brute force attack impossible? Or at least more difficult. Is that not the case or am I missing a key piece of info? (Serious question, not trying to troll or be smug.)</text></item></parent_chain></comment><story><title>Weak passwords brute forced</title><url>https://github.com/blog/1698-weak-passwords-brute-forced</url></story>