Re: "too many auth failures"?

[der Mouse <mouse%Rodents-Montreal.ORG@localhost>]

>> My view is that servers should have two failure counters: one for
>> password and keyboard-interactive, another one for all others.
> Yeah, I'd thought about that too, but where do you stop?  Which
> counter type would a ZKP use?  Or EKE?  Or IBE?

The "all others".

Think about the point of those failure counters: they're designed to
slow down password-guessing attacks.  publickey, ZKP, etc, don't have
anything like password-guessing risks, so it's arguably inappropriate
to do failure counters for them.

/~\ The ASCII				  Mouse
\ / Ribbon Campaign
 X  Against HTML		mouse%rodents-montreal.org@localhost
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B