4 ms·
Do the same on the login page. You have to stop the bots from trying to brute force user accounts and passwords.
by user5994461 8y ago
Do the same on the login page. You have to stop the bots from trying to brute force user accounts and passwords.
- the8472 8y ago> You have to stop the bots from trying to brute force user accounts and passwords. That shouldn't be an issue if the passwords have enough entropy.
- user5994461 8y ago>>> if the passwords have enough entropy. Allow me to optimize your statement. >>> if False
- anticensor 8y agoWhat does it mean? Users always pick low-entropy passwords?
- judge2020 8y agoAlmost always. It's gotten better with the rise of password managers that generate random passwords, but otherwise, passwords are usually shared across many websites and usually less than 16 characters.
- rmc 8y agoNot "always". But you should not build your systems based on the assumption that passwords will be strong enough.
- topkeks 8y agoDon't allow shitty passwords. For example you could use HaveIBeenPwned API to reject previously leaked passwords.
- jstarfish 8y agoNo amount of entropy mitigates a successful credential stuffing attack.
- tedunangst 8y agoNo amount of anything mitigates a successful attack; otherwise it wouldn't be successful.
- Franciscouzo 8y agoIt could be argued that once you use a password more than once its entropy decreases automatically.
- Avamander 8y agoWhy not just captcha everyone?