4 ms·
They becomes a highly effective denial of service vector if you’re not careful.
by QuinnyPig 4y ago
They becomes a highly effective denial of service vector if you’re not careful.
- bastawhiz 4y ago> if you’re not careful. I don't think there's a way to avoid a DOS vector even if you're careful. If someone can access your database directly, they can make enough attempts to lock a user. The only way to be careful is to avoid public access to the db. But if you do that effectively, you don't have the issue of accounts getting locked. It's a dubious argument to ever lock an account as a safety measure. Arguably, downtime is not a good tradeoff, especially if you're following best practices and using a very long, truly random password. An extremely secure db setup shouldn't require you to disable a "safety" feature that creates a new DoS vector because you've followed best practices.
- throwaway744678 4y agoFail2ban is a good mitigation strategy, blocking the IP address after N failed attempts (obviously, it does not protect completely from a determined attacker controlling a network of bots but it raises the bar significantly)