3 ms·
Preventing brute-force attacks with django
- va_coder 15y agofail2ban is good for this as well
- lucian1900 15y agoThat is an issue. But a more significant issue is Django's vulnerability to timing attacks.
- mrj 15y agoDoesn't using bcrypt help with that, or do you mean something else?
- jacobian 15y agoI'm not aware of any timing attacks against Django. If there are attacks that we should be aware of please be a good open source citizen and report them to `security@djangoproject.com`. We take security reports very seriously, and want very much to fix any issues that're disclosed! [edit to clarify: I'm one of the lead developers of Django, and one of the members of the security team that gets emails sent to the `security@` alias.]
- Codayus 15y agoI've been using Django BruteBuster[0], but this project looks interesting. Is it worth switching? [0]: http://code.google.com/p/django-brutebuster/ http://code.google.com/p/django-brutebuster/