4 ms·
Or they change just gate the notifications/MFA requests server side, limit the number of request and set an increasing delay between request.
by joenathanone 5y ago
Or they change just gate the notifications/MFA requests server side, limit the number of request and set an increasing delay between request.
- dane-pgp 5y agoSo if an attacker had access to 2 million IP addresses[0] and they were attacking a country where maybe less than 5 million people[1] have an account on the national authentication system, how easy would it be for them to DDoS the system for a week? Presumably the attackers would choose the week when people were supposed to fill in their tax forms, or (if the country was foolish enough to allow online voting) the week of an election. [0] https://www.bbc.co.uk/news/technology-11531657 https://www.bbc.co.uk/news/technology-11531657 [1] https://www.worldometers.info/world-population/denmark-population/ https://www.worldometers.info/world-population/denmark-popul...
- joenathanone 5y agoAn attack of that size would of course be automated which should make it easy to fingerprint, then just block the matching fingerprint, or add a captcha. Could also add a "I didn't request this MFA" link that would flag the requester.