القوة الغاشمة (Brute force) والقفل والتقييد (Throttling)

في هذا الدرس

slow down guessing without handing attackers a new weapon.

الموضوعات المخطط لها

• Count failed logins per account and per IP; after a limit (for example 5), delay or block for a time.
• Per-account lockout can be abused to lock real users out: a denial-of-service trade-off.
• Prefer temporary lockouts or growing delays over permanent ones.
• Combine with per-IP limits and, later, extra checks like MFA.
• Answer the same way whether the email exists or not: "invalid email or password".
• Password rules: favor length (for example 12 or more) over complex symbols; check against known breached passwords where possible (concept).