3 ms·
As described I don't really see how the solution proposed handles DoS attacks any better than a lock out after x failed attempts. The key to preventing DoS att
by streety 18y ago
As described I don't really see how the solution proposed handles DoS attacks any better than a lock out after x failed attempts.
The key to preventing DoS attacks is that the throttling is specific to a given host so that when the genuine user attempts to log on (presumably from a different host than the attacker) they can do so without any throttling.
- pchristensen 18y agoDoS meaning you can lock people out of their accounts, not that the site is brought down.
- tptacek 18y agoWhich fails against any attacker with a botnet, so, solve the lockout problem first, and deal with DoS (which you can't ever really solve) later.
- sh1mmer 18y agoDoS is a different problem. That's about trying to soak up the entire bandwidth of your servers using lots of computers. If you are throttling number of login attempts per account then it doesn't matter what the IP address being used is.