41 ms·
TOR still uses cookies so a session ID can be set for the user agent and rate limited. DDOS scripts create new sessions on every attack request. It's a very ha
by caleblloyd 11y ago
TOR still uses cookies so a session ID can be set for the user agent and rate limited.
DDOS scripts create new sessions on every attack request. It's a very hard problem to solve without blocking legitimate traffic too.
- newjersey 11y agoWell, at some point you have to block legitimate traffic. My thought was it doesn't have to be black and white. Maybe require the user to solve a captcha after the nth search from the same IP address? How big are the biggest of botnets? A few hundred thousand computers? Or maybe even require captcha for every unauthenticated search.
- driverdan 11y agoRate limiting is IP based, not session based.
- EGreg 11y agoNot that difficult! Simply sign your session ids with an HMAC, to verify the id without any I/O! And require something expensive to create a session (such as a hash-based challenge request). Sessions are usually not needed for static sites, so by the time the person searches, their browser will have earned one session. A spammer on the other hand wouldn't have the computational power to create the various sessions. Also, if a spammer's IP is detected, the computational complexity can be increased for that IP.