4 ms·
Because you want to have delays between bot login attempts?
by tinus_hn 4y ago
Because you want to have delays between bot login attempts?
- joshspankit 4y agoI think that’s overcomplicating it: Just do it site-wide for all login attempts (always on, or like the captcha: as-needed)
- tinus_hn 4y agoSo now in the case of a bot attack no one can login. That doesn’t work.
- joshspankit 4y agoWhat do you mean?
- tinus_hn 4y agoIf you block all logins for 5 seconds after a bot attempts to login, and the bot attempts to login 50 times per second, no one will be able to login.
- joshspankit 4y agoI understand the confusion now. No I mean when a specific user has a failed login attempt that user has to wait 5-30 seconds before being able to try again. A legitimate user would only be affected if a bot is trying to log in as them.
- tinus_hn 4y agoThat’s account lockouts, it doesn’t work against bots because they can just try a million accounts instead of a million passwords on one account and it makes it super easy to do a denial of service on an account, and it doesn’t prevent a denial of service against the server that has to service all these login attempts that might very well involve running hashes designed to be computationally intensive, like PBKDF2. This is not a novel measure, rest assured that the people that choose to implement captcha instead are aware of its existence and chose for the captcha instead.