5 ms·
Throttle based on what? IP address? This works for domestic IT departments looking to shut out automated attempts from specific ranges but at Google's scale IP
by Phlarp 8y ago
Throttle based on what? IP address? This works for domestic IT departments looking to shut out automated attempts from specific ranges but at Google's scale IP based filtering could end up shutting out an entire country.
- mathnmusic 8y agoWhich country uses a single IP address for all its devices/citizens?
- ReverseCold 8y agoChina Telecom does something weird with NAT, not sure what exactly but I've seen it mentioned here before
- dlubarov 8y agoAll of Qatar's traffic used to be routed through 82.148.97.69, though that was back in 2006-2007. At one point it was banned from Wikipedia, which unintentionally affected the whole country. https://simple.wikipedia.org/wiki/User_talk:82.148.97.69 https://simple.wikipedia.org/wiki/User_talk:82.148.97.69
- lisper 8y ago> Throttle based on what? User Id?
- ryantriangles 8y agoWith credential stuffing, isn't it unlikely the perpetrator wants to make more than one or two attempts per user ID?
- Too 8y agoThat's the first obvious countermeasure and will prevent hackers targeting a specific account. But there are other ways to crack passwords, one is to try the same password but iterate over user ids instead. As hackers would start with the most common password you can't throttle globally on same password attempts either because well yeah, it is by definition the most commonly used one which should have a lot of traffic.
- QasimK 8y agoGoogle can ban common passwords, or passwords that look like they’re being targeted (over the long-run).
- sdjhksgsdfsaa 8y agoThis has nothing to do with anything but I don't know how else to get in touch with you. Could you upload your zero spam email setup guide somewhere? Your site was hacked so the link I had doesn't work: http://iamqasimk.com/2016/10/16/absolutely-zero-email-spam/ http://iamqasimk.com/2016/10/16/absolutely-zero-email-spam/
- QasimK 8y agoI’m sorry, I changed the domain to QasimK.io, but neglected to set up forwarding. I will do that. http://qasimk.io/2016/absolutely-zero-email-spam/ http://qasimk.io/2016/absolutely-zero-email-spam/
- lewiscollard 8y agoThat would create an easy denial of service attack: if I wanted to deny you access to your account I'd spam it with bad login attempts.
- homero 8y agoHappens weekly to my Sears account.
- michaelt 8y ago"Credential stuffing" as I've heard it used refers to taking username/password combos from one breached site and trying them in other sites. So for example LinkedIn has a breach, which reveals to evildoers that user 'johnsmith@example.com' uses the password 'smith1234' then they test that username and password in Amazon, Netflix, Steam and so on. They only make one attempt per account, because they only have one leaked password per account. Hence, throttling per account isn't an option.
- gyaru 8y agoThat's a terrible idea. Back when MSN was one of the most common instant messengers, there was a common prank that was called "freezing" where you just continuously kept trying to log into someones account and it would lock itself out for 15mins or more depending how long you kept doing it. There was automated tools that did this too!
- yanonymous2 8y agomd5sum(userid + ip) That way you don't log private user data (EU laws etc) and it can't be used to lock someone out of their account. The only way around this is to attack from a lot of different IPs and that, too, is very easily detectable and solvable in a user friendly way. Really, how hard is it? I would expect this to be the default for big companies by now.