4 ms·
at my first job I was able to identify a remote username enumeration vulnerability which, when combined with cred stuffing based on some publicly known cred dum
by ratelimitsteve 1y ago
at my first job I was able to identify a remote username enumeration vulnerability which, when combined with cred stuffing based on some publicly known cred dumps, netted me a couple dozen good user accounts on our web app. we ended up rate limiting login attempts and adding random delay to failed logins to mitigate the username enumeration vuln (tldr - if you sent creds w a nonexistent username the system immediately failed the login attempt, but if you sent w a good username and any password the system had to take time to hash and salt your password then compare it to the stored hashed passwords, so attempts w a good username have a much higher latency than w a bad one)
- tracker1 1y agoYeah.. I started adding a random 1-4 second delay returning from failed logins regardless of the reason when creating auth systems. I really wish I would have been able to open-source the auth platform I wrote at a previous job. It wasn't that complex, but pretty nice in that it had pretty typical features for auth, was simple to setup/configure and would simply generate a signed jwt passed to your app/url. I had db adapters to be able to use SQLite, MS-SQL, PostgreSQL and DynamoDB. It also had integrations for AD, Okta and Azure Entra.