3 ms·

So how do you stop bots from submitting fake data to sign up forms or trying to brute force password fields etc. on websites?

• the8472 7y ago
  > brute force password fields rate limit > stop bots from submitting fake data to sign up forms I don't think there's an universal solution here. it depends on the application itself and why you consider fake signups an issue in the first place.
  • j88439h84 7y ago
    Rate limit by what? Username? IP?
    • the8472 7y ago
      per user if you want to defend against targeted attacks. per IP if you want to prevent untarged attacks. so, both. add an email-reset for the limit so users can't be locked out of their accounts by a DoS.
• amluto 7y ago
  For passwords: offer 2FA (ideally WebAuthn, but it sadly hasn’t landed in enough browsers yet), use a reasonable password strength policy, and possibly consider OAuth login. Or, and I know this is crazy talk, allow users to opt out of the bloody captcha if they say they use a password manager, and then use some basic heuristic requirements on the password. But stop making me click the friggin’ stop lights every time I log in to my own account.
• mholt 7y ago
  Circuit-break after 5-10 failed attempts and require 30s or 1m before each attempt after the first 3 failed ones. To stop fake signups, require confirming the email address and only allow some number of signups per IP per day. It's not perfect but neither are CAPTCHAs and either way you can probably stop most spam, if it's even a problem for you.