4 ms·
is rate limiting a defense against this? I get that these attacks could come from a botnet, but it at least increases the necessary size of the botnet. Is ther
by awinter-py 10y ago
is rate limiting a defense against this? I get that these attacks could come from a botnet, but it at least increases the necessary size of the botnet.
Is there a service for correlating failed login attempts across sites?
- mikey_p 10y agoIt's only a deterrence, not a defense. The attacked can always wait it out, or attack multiple sites at once to slow things down. You also have to watch out for rate limiting becoming a way for attackers to DDoS your legitimate users.
- gnode 10y agoI imagine a better alternative would be, having identified an attack (via rate or otherwise), to let the attacker try their list, and for each successful password match deny access (indistinguishably from an incorrect password), silently invalidate the password, and email the legitimate user.