4 ms·
> could be straightforwardly removed or replaced with rate limiting login attempts per IP This is very outdated intuition. Fresh IP addresses cost peanuts. Fo
by hombre_fatal 6y ago
> could be straightforwardly removed or replaced with rate limiting login attempts per IP
This is very outdated intuition. Fresh IP addresses cost peanuts.
For example, your solution still allows an attacker to run a 50k item /login combolist against one of your users with $5 of botnet time, each IP address trying a single uname/pass combo.
Here you pay $18/GB to multiplex your abuse (cred stuffing being classic non-volumetric abuse example) across 72 million residential IP addresses. https://luminati.io/ https://luminati.io/
- mindslight 6y ago50k attempts is tiny, like a 3 character password or a single account run through /usr/share/dict/words. If you're worried about password with between other sites that have leaked, then the real answer is to generate something like a username for each user that they won't be able to share between sites. In fact with the prevalence of password managers, generating users' passwords for them might just be the better approach these days. And just fall back to email auth every time if they don't want to store it. Duct taping your broken system by throwing up an annoyance for every user who doesn't want to be tracked is not the way.
- GekkePrutser 6y agoI would start with blocking those 72 million addresses for starters :)
- Aunche 6y agoMany of these ip addresses would also be shared by servers of legitimate businesses and VPNs.
- GekkePrutser 6y agoTrue, but blocking them stimulates them to stop renting them out to such services.
- BMSmnqXAE4yfe1 6y agoThis scenario is not realistic, as you can just lengthen time between subsequent login attempts per username.
- mobjack 6y agoAttackers only need one attempt per username. They will use a leaked list of millions of username and passwords, then use a botnet to try them all on another website.