4 ms·
They also suggest "Account lockout". > The most common protection against these attacks is to implement account lockout, which prevents any more login attempts
by Aldipower 5y ago
They also suggest "Account lockout".
> The most common protection against these attacks is to implement account lockout, which prevents any more login attempts for a period after a certain number of failed logins.
Imho account lockout has a huge downside.
It reveals the username to attackers, because only on correct usernames the account lockout hooks in.
I just would keep it silent and throttle the requests down on any false attemp.
- SixDouble5321 5y agoLock out fake users too? Seems simple enough.
- Aldipower 5y agoHmm, sounds easy! :-D But isn't, you need to keep track of fake users somewhere, which is another attack vector for DoS.