Ah, that kind of passwordless - thanks for the correction.

The passwordless I always use is the one where you turn on the machine and have access to the desktop without entering credentials.

In some “passwordless” configurations - in other words: working as designed.

Difference being: the subsidized copper was actually installed and put to use.

The subsidized fiber is mostly vapor.

The problem with rural connectivity is cable-miles per subscriber. When the US rolled out copper telephone lines to the boonies that was HEAVILY subsidized by urban customers.

In the early days of cable internet, the first people in a neighborhood would get it and rave about how amazingly fast it was. Then a 2nd subscriber would get it and their down/upload speeds would drop by half when both tried to use it at once, then 3, 4, 10, 100 people would start sharing the same bandwidth and the clueless cable TV company employees would just tapdance without really fixing anything - which would require corporate to approve expensive upgrades to their backend.

Around here lately 5G based internet seems to be the same - they’re trying a little harder, making fixed location subscribers declare where they are and charging mobile users much more, but it’s inevitable: if you’ve got 100 homes all trying to use one tower at the same time, it’s not going to go smoothly.

and would not raise red flags with the registrar

That’s the real determing factor here, they are visibly limiting to 10 tries every 10 minutes, but if there’s another limit such as 100 failed tries per password (per 2 hours) absolute max or whatever, that can make a huge difference.

If you want to hope for unicorns and rainbows, you might even think they use the higher failure limit as a flag to start investigation into where the abuse is coming from and doing what they can to stop it at its source - you’d want to encourage the abusers to keep trying in order for that kind of scheme to work.

I just had an idea for a system which lets you try 10 times in 10 minutes, lets you bypass that limit by tossing your cookies or whatever, but - after 100 failed tries on this 2 hour password, even if you guess correctly it doesn’t let you in anyway, just acts like you put in another wrong guess, but… for attackers that continue to try it initiates a backtrace…

It all comes down to how many times you are practically allowed to try and what percentage chance is “good enough” for your purposes.