3 ms·
Have you tried rate limiting based on the user account? That should block a distributed attack since each login would count against the rate limit independent o
by greenyouse 9y ago
Have you tried rate limiting based on the user account? That should block a distributed attack since each login would count against the rate limit independent of the IP address.
- ScottBurson 9y agoHow would that help in this situation? The attacker had a database of user/password pairs they were trying; they weren't trying to brute-force a particular account.
- greenyouse 9y agoOops, you're completely correct. I was thinking of the brute force scenario.