3 ms·
It’s not easy to tell two login attempts are from one bot. This kind of workaround unfortunately doesn’t work in practice. Otherwise of course this whole proble
by tinus_hn 4y ago
It’s not easy to tell two login attempts are from one bot. This kind of workaround unfortunately doesn’t work in practice. Otherwise of course this whole problem wouldn’t exist.
- joshspankit 4y agoWhy would you have to tell if they’re from one bot?
- tinus_hn 4y agoBecause you want to have delays between bot login attempts?
- joshspankit 4y agoI think that’s overcomplicating it: Just do it site-wide for all login attempts (always on, or like the captcha: as-needed)
- tinus_hn 4y agoSo now in the case of a bot attack no one can login. That doesn’t work.
- joshspankit 4y agoWhat do you mean?
- tinus_hn 4y agoIf you block all logins for 5 seconds after a bot attempts to login, and the bot attempts to login 50 times per second, no one will be able to login.
- joshspankit 4y agoI understand the confusion now. No I mean when a specific user has a failed login attempt that user has to wait 5-30 seconds before being able to try again. A legitimate user would only be affected if a bot is trying to log in as them.
- tinus_hn 4y agoThat’s account lockouts, it doesn’t work against bots because they can just try a million accounts instead of a million passwords on one account and it makes it super easy to do a denial of service on an account, and it doesn’t prevent a denial of service against the server that has to service all these login attempts that might very well involve running hashes designed to be computationally intensive, like PBKDF2. This is not a novel measure, rest assured that the people that choose to implement captcha instead are aware of its existence and chose for the captcha instead.