4 ms·
> Attackers would loop through giant lists of leaked username / passwords using a different ips for every attempt Mny password attempts for 1 username, isn't i
by stef25 5y ago
> Attackers would loop through giant lists of leaked username / passwords using a different ips for every attempt
Mny password attempts for 1 username, isn't it easier to slow down attempts to authenticate the username after x tries, regardless of the IP? Just the fact that multiple IPs are being used for 1 username in a loop is enough of a red flag.
> Blocking passwords at signup that existed in haveibeenpwned's database worked fairly well
That's half a billion passwords to disallow?
- notatoad 5y agojust pick which size list you want to disallow: https://github.com/danielmiessler/SecLists/tree/master/Passwords/Common-Credentials https://github.com/danielmiessler/SecLists/tree/master/Passw...
- tialaramex 5y agoIf you refuse to out-source this capability for whatever reason, it's also ideal as a micro-service. It has no dependencies on your other components, all it does is take one parameter (the password or more likely an ordinary hash of it) and respond yes it's pwned or no it isn't.
- oefrha 5y ago> Mny password attempts for 1 username Credential stuffing isn’t password bruteforcing. You don’t try half a billion passwords for one username. Instead, you try countless previously leaked username/password combinations from many ostensibly benign residential IPs. Each user account may only see one attempt. The goal isn’t to break into a specific account, but rather, to compromise as many as possible.
- littlecranky67 5y agoUsing IPs to block attempts is no longer feasible since the IPv4 shortage. Mobile carriers in Europe and even landline cable providers use NAT for IPv4, so thousands of legitimate users will appear to use the same IPv4.
- deleted 5y ago[deleted]
- xur17 5y ago> Mny password attempts for 1 username, isn't it easier to slow down attempts to authenticate the username after x tries, regardless of the IP? Just the fact that multiple IPs are being used for 1 username in a loop is enough of a red flag. Nope, one attempt per username - they were using a giant list of hundreds of thousands of leaked credentials. > That's half a billion passwords to disallow? Yup.