3 ms·
>How do you prevent credential stuffing attacks? Passkeys or magic links seem like the way forward here.
by nisegami 18d ago
>How do you prevent credential stuffing attacks?
Passkeys or magic links seem like the way forward here.
- hombre_fatal 18d agoYou can also randomly generate a password for the user on the form they'd normally type one in on registration. Add a "Regen" button to give users more visceral control over it before they submit the form.
- account42 17d agoThat's essentially the same as magic links because most users won't remember/save that password and will have to rely on the usually email-based reset flow.
- hombre_fatal 16d agoSure, but this subset of user was going to otherwise reuse their password and be susceptible to cred-stuffing. The point is to stop the attack and prevent users from accidentally hosing themselves.
- nisegami 17d agoIsn't that essentially a manual passkey?
- JoshTriplett 17d agoPlease don't. I find such services obnoxious, especially when they aggressively log you back out. Chasing down a link in your email is much slower than having your password manager fill in the long unique random password and hitting "log in".
- nisegami 17d ago>Chasing down a link in your email is much slower than having your password manager fill in the long unique random password and hitting "log in". That's basically a passkey without its special API.