2 ms·

> brute force password fields rate limit > stop bots from submitting fake data to sign up forms I don't think there's an universal solution here. it depends

> brute force password fields rate limit > stop bots from submitting fake data to sign up forms I don't think there's an universal solution here. it depends on the application itself and why you consider fake signups an issue in the first place.

j88439h84 8y ago
Rate limit by what? Username? IP?
- the8472 8y ago
  per user if you want to defend against targeted attacks. per IP if you want to prevent untarged attacks. so, both. add an email-reset for the limit so users can't be locked out of their accounts by a DoS.