3 ms·
Rate limiting login attempts means I can prevent you from logging in indefinitely by pushing your account into the rate limited status.
by yetanotherjosh 8y ago
Rate limiting login attempts means I can prevent you from logging in indefinitely by pushing your account into the rate limited status.
- esotericn 8y agoOnly as long as you keep up the attack.
- repiret 8y agoBut an attack that keeps rate limits saturated doesn’t require much bandwidth (you know, because rate limits) and is therefore easy to keep up. Most services would consider it unacceptable if a script kiddie with a botnet and a generic list of usernames were able to prevent even 1% of their users from logging in.
- wild_preference 8y agoSo your solution is "sorry, come back later when the attacker hopefully stops"? I can keep you out of your account indefinitely with a curl loop and a rotation of proxies?