6 ms·
Somewhat related, but anyone have any best practices or can recommend a service to protect your users who have been pwned in another sites data breach? Rate li
by snowwolf 9y ago
Somewhat related, but anyone have any best practices or can recommend a service to protect your users who have been pwned in another sites data breach?
Rate limiting login attempts for an email address or ip address is all well and good for protecting against brute force attacks, but when the attacker has the correct email and password combination already for the user, and access to massively distributed botnets, how do you block those logins?
- chillydawg 9y agoYou email the account owner and tell them they've tried to login from somewhere new and ask for their permission to allow the login. If the email has already been pwned, then, well...I don't know, it's game over really.
- snowwolf 9y agoThat does kind of confirm to the attacker that the credentials are valid on your system though. And do you do this for every different IP? Kind of annoying for users with dynamic IPs.
- erichurkman 9y agoEvery site (with a few rare exceptions) lets you confirm whether an email is a real account or not. You can block the reset password and login flows ("If you've entered a valid email address, we will email you instructions to reset your password" / "Your username and/or password is incorrect"). But every site still exposes it during the sign-up process ("You already have an account. Login here >"). Hiding it during the login flow is largely security theater leading to a poor user experience making people guess & check which email address they used for your service. If you cannot do more advanced risk analysis: a) email the user after a few failed attempts, b) lock the account down for a period of time, c) lock that IP out from attempting any logins for a period of time, and most importantly, d) monitor lock outs. If an account is getting locked out frequently, be proactive and reach out. 99 out of 100 times it's the user struggling with things like your password requirements, but 1 out of 100 it might be an attacker.
- norlys 9y agoI've read something about a method used by online banking services some time ago: They tracked the way the customer moves their mouse, calculated their arm lenghts etc. and when the movements were suspiciously different, the system assumes it's a fraud and logs them out.
- gesman 9y agoI did similar project with Tensorflow. Mouse movements were captured then converted to images and DL model was trained to classify user or not user. It can also classify classes of users I.e. new portal users are moving mouse differently from users who are familiar with portal. To add - by itself it’s not a reliable indicator of yes/no. But rather another risk scoring input to overall identity detection system.
- rayuela 9y agoThis is actually clever. Thanks for sharing the technique!
- gesman 9y agoPleasure :) Here's writeup: https://www.splunk.com/blog/2017/04/18/deep-learning-with-splunk-and-tensorflow-for-security-catching-the-fraudster-in-neural-networks-with-behavioral-biometrics.html https://www.splunk.com/blog/2017/04/18/deep-learning-with-sp...
- rpedela 9y agoAWS Cognito just announced some security features to help with that. https://aws.amazon.com/about-aws/whats-new/2017/11/announcing-advanced-security-features-beta-for-amazon-cognito/ https://aws.amazon.com/about-aws/whats-new/2017/11/announcin...
- jakub_g 9y agoIt looks like something that Distil [1] is doing, among other things. AFAIK they will be expanding this functionality in the coming months. Disclaimer: My company have been using Distil for a few months; mainly for detecting and blocking bots, but they provide a range of other security features. https://resources.distilnetworks.com/customer-stories/account-takeover-fraud-solved-for-entropay https://resources.distilnetworks.com/customer-stories/accoun...