4 ms·
By the account. 3 failed login attempts in a row, and you disallow further logins for 30 seconds. This should waste less time than reCAPTCHAs. I know it's not
by basilgohar 7y ago
By the account. 3 failed login attempts in a row, and you disallow further logins for 30 seconds.
This should waste less time than reCAPTCHAs. I know it's not 1:1 in terms of pros/cons, but it gets a good subset of the advantages without the key disadvantages mentioned above.
- hombre_fatal 7y agoSo I can lock you out of your account with 3 attempts from any IP address?
- wolco 7y agoFor a minute usually. Prevents flooding. Not a bad approach unless the account is constantly hit. In those cases two factor auth makes sense.
- DownGoat 7y agoThis is obviously a bad idea. It costs nothing for an attacker to send 3 http requests, every minute, every hour, all day. They could lock your account basically forever. IP filtering and locking accounts are terrible ways of preventing password spraying.
- atombender 7y agoFirst, that's a bit user-hostile (and suddenly a DoS-vector; I can prevent a site's users from logging in by continuously firing bad password attempts). Secondly, botnets can, and presumably do, randomize which accounts they try, too.
- yc12340 7y agoSo rate-limiting is "user-hostile", but permanently hell-banning someone because their network is considered "seedy" is user-friendly? Incidentally, you still need rate-limiting if you use Google's CAPTCHA. If you don't rate-limit CAPTCHA endpoint, an attacker can DDoS you (especially if your server-side captcha component uses low-performance single-threaded HTTP client). Furthermore, an attacker within the same AS as their target can purposefully screw over their account by performing attacks on Google's services until the reputation of the network hits rock bottom.
- tyler_larson 7y agoreCAPTCHA is a rate-limiting measure. Google handles all the heavy-lifting and attacker protection for you, and the slow fade you see in the video is that rate-limiting in action. But if you get a clean CAPTCHA result back from them, then that client is very unlikely to be an automated attacker. It's super easy and scales really well. Conveniently, normal users with typical browser configurations get nothing but the animated checkbox. For nearly everyone, the whole experience is simple and easy. The only people who get inconvenienced are the low-grade privacy enthusiasts who think that preventing tracking is the path to Internet safety. Ironically, "tracking" is literally the mechanism by which legitimate users can be distinguished from attackers, so down that road lies a sort of self-inflicted hell for which the only sensible solution is to stop hitting yourself.
- userbinator 7y agoso down that road lies a sort of self-inflicted hell for which the only sensible solution is to stop hitting yourself. "Be a good little sheeple and do what Big Brother Google says." Fuck no.
- LaGrange 7y ago> By the account. 3 failed login attempts in a row, and you disallow further logins for 30 seconds. ...congratulations, I just locked out all of your users. Have a nice day.
- Kaiyou 7y agoHow did you get the email addresses of all my users, which are used as login name?
- LaGrange 7y agoFrom that messed up email from support that leaked them. Or I assumed that you'll have a big cross-section with some other site that leaked. This is not theory, this is hard-earned experience. Locking-out people is bad, the most that's acceptable is rate limiting to a once every few seconds.