Rate limiting per-IP assumes an attack from a single IP, or a very small range of them (so, only defends against a trivial DoS, not DDos... which are sadly easy to set up these days).<p>Per-IP per-account as well doesn&#x27;t work if the attacker has a large list of usernames.  Even brute-force &quot;dictionary&quot; attacks can dodge simple limiters by submitting one password with 2 million diff usernames, then a second password with 2 million usernames, etc..<p>I&#x27;m not saying these are <i>bad</i> (though if someone can trivially stop your real users from signing in by hitting the limit on their accounts, that&#x27;s just a DoS in another shape).  But we&#x27;re agreed already... these are non-simple problems, really.