3 ms·
Though I agree rate limiting should be done (and done carefully), it is not very effective in all cases. As just 1 example, a determined attacker who wants to p
by rphlx 9y ago
Though I agree rate limiting should be done (and done carefully), it is not very effective in all cases. As just 1 example, a determined attacker who wants to pop any account can make 3 attempts on hundreds of thousands of accounts, using a unique IPv4 address per account, thanks to Windows & IoT botnets.
- odammit 9y agoWAF, IP blacklists, naive bot detection[0] and why would a decent thresholding system allow for a single IP to fail multiple accounts in a short time period. If you hit two valid accounts [1] with bad passwords in a few ACCEPTABLE_UNIT_OF_TIME, it’s captcha time. Thresholding isn’t just action per IP it’s being smart about how people are going to attack your system. It requires thought and upkeep. [0] Previous thoughts on bot detection: https://news.ycombinator.com/item?id=16182405 https://news.ycombinator.com/item?id=16182405 [1] Also, if your login identifier and your public “display names” (usernames) are the same thing, that is a disservice to your users’ security.