SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-rate-limit-guessing

Which control limits how many failed login attempts can be made on an account?

Rate limiting, a cap on failed authentication attempts.

Start playing free

  1. Key escrow
  2. Rate limiting or throttling ✔
  3. Data masking

Why: Online guessing needs many tries. Throttling or lockout slows brute force and keeps attackers from testing millions of passwords.

Huh, didn't know that: NIST also says verifiers must allow password managers and autofill.

The dad joke
A rate limiter is polite but firm. It says, one at a time, please.
Like this card?
Play the game

References

Answer: Rate limiting or throttling. Online guessing needs many tries. Throttling or lockout slows brute force and keeps attackers from testing millions of passwords.

  1. NIST SP 800-63B-4, Authentication and Authenticator Management pages.nist.gov/800-63-4/sp800-63b.html
    Verifiers SHALL implement a rate-limiting mechanism that effectively limits the number of failed authentication attempts
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyYou sign in, and then the system decides which folders you may open. What is that second step?Security & PrivacyGiving each user only the access needed for their assigned tasks follows which principle?Security & PrivacyCapturing valid login data and sending it again later to impersonate a user is called what?

That's stuff everyone should know.