2 ms·

Yeah, but not usually easy enough that you can make hundreds/thousands of them quickly for a single purpose and then throw them away. Also, as a slight tweak,

by derefr 4y ago

Yeah, but not usually easy enough that you can make hundreds/thousands of them quickly for a single purpose and then throw them away. Also, as a slight tweak, I'd hope that this authentication scheme would only admit legal companies that are at least a week old. People who do these sorts of bulk-registration attacks tend not to be patient people, willing to wait around for their credentials to gain reputation before using them. They create them and then try to use them right away. Whereas no real company would be signing up for most B2B services in its first week of legal existence. (Google Workspace? Sure. Accounting software? Probably not.)

rovr138 4y ago
Ultimately this depends on what the attack is. If it's targeted to X company for a specific reason, they'll wait however long they need. If it's generic and X company is just caught in the crossfire, then maybe. >Whereas no real company would be signing up for most B2B services in its first week of legal existence. (Google Workspace? Sure. Accounting software? Probably not.) When I've registered companies in the past, it's when I have sales. Before then, it's just an idea to see if we get users. But the company with the service can determine that.