Mitchell-JohnsonandClaude Opus 5 a0987c940f Twenty login tries before the backoff starts, not five ...

A guest password is typed by hand off a message on a phone. Five tries is not
many when a hyphen lands in the wrong place, and being told to wait is worse
than the brute-force risk here: past twenty the doubling lockout still applies,
the global backstop is unchanged, and the password is ~78 bits.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-09-27 18:04:23 -07:00

..

auth.go

Twenty login tries before the backoff starts, not five

2026-09-27 18:04:23 -07:00