I'm guessing it would be limited to 15 incorrect verifications within 60 minutes. After that you would be blocked. I'm not 100% sure but that seems like the logical answer. Maybe someone from twitter can confirm this.
On Tue, Aug 4, 2009 at 3:40 PM, Bob Fishel <[email protected]> wrote: > > I hate to "bump" this as it were but does anyone have any insight? > > Thanks, > > Bob > > On Tue, Aug 4, 2009 at 1:45 AM, Bob Fishel<[email protected]> wrote: > > From the api documentation: > > > > "Because this method can be a vector for a brute force dictionary > > attack to determine a user's password, it is limited to 15 requests > > per 60 minute period (starting from your first request)." > > > > Is this per user? > > > > ie: if my server queries user A and gets credentials verified ok after > > 14 other users verify am I locked out or is it just after 15 tries for > > the same user? The former would seem illogical but I just want to make > > sure... > > > > Thanks, > > > > Bob > > > -- Josh
