2 ms·
More details on existing services or libraries for rate limiting would be nice. Still an informative article.
by unethical_ban 1y ago
More details on existing services or libraries for rate limiting would be nice. Still an informative article.
- bobbiechen 1y agoThe author, Dan, is at FusionAuth, so that might be a good place to start. I work for Stytch (another CIAM provider) on the fraud and security side and we do these too. I'd say you see credential stuffing defenses integrated into the auth provider rather than standalone rate limiting because so much of the relevant context is tied up in the auth side. And, all the error messages end up being bad, as is the case for many security things. For our own features like Intelligent Rate Limiting https://stytch.com/docs/fraud/guides/device-fingerprinting/decisioning/intelligent-rate-limiting https://stytch.com/docs/fraud/guides/device-fingerprinting/d... it's usually a bad idea to tell a user "You hit the limit, come back in an hour or contact support" because it gives an attacker information on how to improve. And we regularly see probing behavior where an attacker is trying to find the edges of a defense before starting a full-scale attack. On the side topic of error messages - if you've ever seen "If your account exists, the password has been reset" that's another useless error message because "No account exists with that email" enables account enumeration.
- mooreds 1y agoThanks for the feedback, appreciate it. I wanted a general overview of the problem and solutions first. Maybe I'll write a follow on article about services or libraries. Love how the HN community is sharing rate limiting and other credential stuffing "war stories" here too.