4 ms·

I keep track of login attempts via Redis based on IP address. As soon as one IP address attempts to sign in under different account name (e-mail in my case) and

by vizzah 8y ago

I keep track of login attempts via Redis based on IP address. As soon as one IP address attempts to sign in under different account name (e-mail in my case) and wrong password, IP is added to the set. Once there were more than 3 similar attempts, web server starts to return '403 Unauthorized' errors. In a few minutes (cronjob) IP address is added to the blacklist of 'ipset' (great tool for managing and keeping IPs in sets for iptables), which results in all connections from the offender silently discarded in a kernel firewall. Define your own terms when to purge sets and offer amnesty.

eli 8y ago
Your legitimate users don't ever forget their username and take a few guesses?
maxyme 8y ago
This method discards real traffic though. Consider that many networks exist with shared IP addresses. At my dorm in college we all had the same IP and often had trouble signing in on Reddit because if you failed your first sign in attempt you'd get locked out for 30 minutes. We also got cloudflare captchas often but at least these methods were temporary and upfront to the user, your method just breaks the site for real users. This will only become more common, consider ipv4 tunnels.
tnolet 8y ago
This is a really really bad way of dealing with abuse. Many companies, universities, libraries etc. share outgoing IP's with many users.
- vizzah 8y ago
  Obviously, what I described was a "basis description". There are many tricks employed to decrease risks of legitimate IPs from being banned. For example, only invalid login attempts from the same IP with several non-existent and invalid password accounts are counted and then counter is reset every 24 hours. Based my site's usage patterns, legitimate users are very unlikely to get flagged in those situations, but I've successfully banned over 65k IPs of botnets trying to bruteforce over stolen email/passwords combos..
detuur 8y ago
I have several e-mail addresses, that I use in combination with several passwords across services. While there's some consistency in which pw I use where, it's not definite. This leads to situations where I have to soft-bruteforce my way through the different combinations of user:pw that are possible. Services that deny me (worse yet, permanently) after a few failed attempts are the bane of my existence. I've since moved to a password manager, but before they were commonplace this was the only somewhat convenient way to give yourself some protection against password leaks.
- vizzah 8y ago
  As a trade-off to prevent legitimate users from trying to login with non-existent credentials, I display "this login does not exist" message. So unless the customers attempt to enter numerous different logins anyway - they are safe. I am not worried about bots trying to validate various account lists and build "existing users" list of my service, because those enumerating attempts are quickly prevented.

by vizzah 8y ago

eli 8y ago

Your legitimate users don't ever forget their username and take a few guesses?

maxyme 8y ago

This method discards real traffic though. Consider that many networks exist with shared IP addresses. At my dorm in college we all had the same IP and often had trouble signing in on Reddit because if you failed your first sign in attempt you'd get locked out for 30 minutes. We also got cloudflare captchas often but at least these methods were temporary and upfront to the user, your method just breaks the site for real users. This will only become more common, consider ipv4 tunnels.

tnolet 8y ago

This is a really really bad way of dealing with abuse. Many companies, universities, libraries etc. share outgoing IP's with many users.

vizzah 8y ago
Obviously, what I described was a "basis description". There are many tricks employed to decrease risks of legitimate IPs from being banned. For example, only invalid login attempts from the same IP with several non-existent and invalid password accounts are counted and then counter is reset every 24 hours. Based my site's usage patterns, legitimate users are very unlikely to get flagged in those situations, but I've successfully banned over 65k IPs of botnets trying to bruteforce over stolen email/passwords combos..

detuur 8y ago

I have several e-mail addresses, that I use in combination with several passwords across services. While there's some consistency in which pw I use where, it's not definite. This leads to situations where I have to soft-bruteforce my way through the different combinations of user:pw that are possible. Services that deny me (worse yet, permanently) after a few failed attempts are the bane of my existence. I've since moved to a password manager, but before they were commonplace this was the only somewhat convenient way to give yourself some protection against password leaks.

vizzah 8y ago
As a trade-off to prevent legitimate users from trying to login with non-existent credentials, I display "this login does not exist" message. So unless the customers attempt to enter numerous different logins anyway - they are safe. I am not worried about bots trying to validate various account lists and build "existing users" list of my service, because those enumerating attempts are quickly prevented.