3 ms·
Credential stuffing more commonly refers to the practice of getting valid sets of creds from various password database dumps and retrying them across common/pop
by raesene9 8y ago
Credential stuffing more commonly refers to the practice of getting valid sets of creds from various password database dumps and retrying them across common/popular systems.
2FA is a good defence against it, but lockouts are less as they attacker will be going broad and not deep (could be a single request per user account)
- tinus_hn 8y agoI don’t see how JavaScript is anything more than a bandaid for that. The assumption is the attacker has the usercode and password combination and then you want to prevent him from logging in.
- rocqua 8y agoIp based lockouts as opposed to account based lockouts do better against cred stuffing. Because there is a cost to getting more IP adresses. Maybe carrier grade NAT would lead to too many false positives?
- delroth 8y agoMost bad actors doing abuse at scale have access to large networks of proxies on residential or mobile IPs, usually backed by malware on workstations, laptops and mobile phones. Even as a newcomer without the right contacts on the black market you can get started with very little upfront investment, using services like https://luminati.io/ https://luminati.io/ (they pay software developers to bundle their proxy endpoints within their apps).
- tinus_hn 8y agoIPv6 addresses aren’t really scarce.
- delroth 8y ago/64 and /48 are pretty much on the same order of magnitude as IPv4s in terms of difficulty of acquisition, and I don't know why you would ever look at more than /64 when most major operating systems randomize the last 64 bits anyway (RFC4941).
- astura 8y agoCred stuffing is using botnets, you aren't going to have more than a couple login attempts per IP.