Why don't we see more D.O.S. attacks on individual accounts?

[johnridley]

A recent event reminded me of something that I've been wondering about for years:

Given the prevalence of "3 strikes and you're out" login pages, where if you fail to input the correct password 3 times, your account is locked and you have to go through a sometimes painful and always time consuming process to get it unlocked, why do we not see this emerging as an attack vector, either to just be a general pain in the butt or to specifically bother one person?

If I know the person's account name, which is quite likely on things like online forums, I can easily lock their account by simply entering the wrong password for them 3 times. If I do it from a public computer, or through an open wifi connection, it probably can't be traced back to me?

I don't think I'm exactly the nastiest person on the planet, so if I thought of this years ago, why is it not happening a lot? Maybe it is, and it's just too small potatoes to get press?

Comments

[scs-11.livejournal.com]

IMnotsoHO, the three-strike-and-block method has become very rare as a result of the conditions you describe.

[nicegeek.livejournal.com]

I think in most cases the lockout is temporary, and resets after 15 minutes or an hour.

[jon787.livejournal.com]

Conficker actually caused this when it infected many businesses.