3 ms·
It's effectively a rate limiter, where before the Bad Person/People could make 10,000 users per unit of time before, now they may only make 100 users. It won't
by spijdar 5y ago
It's effectively a rate limiter, where before the Bad Person/People could make 10,000 users per unit of time before, now they may only make 100 users. It won't fix the problem entirely, but it's better than nothing.
- d--b 5y agoBut people can still run several sessions of this. So if I have 100 cores available, I can run 100 sessions in parallel.
- spijdar 5y agoRight, but they still will be slower than if there was no protection at all. 100 slower cores vs 100 cores churning out requests ASAP. For a determined or resourceful attacker, this alone won't be good enough defense, but I can see it being a layer of defense in depth.
- ReactiveJelly 5y agoSee my other comment about auto-scaling. Adjusting difficulty for PoW is trivial. Have the server crank up the challenge if it's getting more traffic than normal.
- kevincox 5y agoOr base the challenge difficulty based on other parameters. For example if your IP has had a lot of failed login attempts recently the difficulty can be increased.