29 ms·
If you resort to blocking IP ranges to prevent attacks, you are missing the point of how to properly respond to an attack. Blocking ranges might by an extra lay
by mrb 14y ago
If you resort to blocking IP ranges to prevent attacks, you are missing the point of how to properly respond to an attack. Blocking ranges might by an extra layer of security (philosophy of defense in depth), but in addition to that you should analyze how this email user account was compromised.
Weak password was bruteforced? Start enforcing strong passwords.
Email server vulnerability exploited? Patch your server.
Etc.
- eksith 14y agoPassword length and complexity aren't all that critical if it's salted and hashed. Locking out a user after a number of incorrect attempts and then requiring a different password during the reset than the one already used is a better alternative. Reusing passwords on different sites is a much bigger problem IMO since a lot of places still don't store passwords correctly or don't lock out users after failed attempts.
- cantankerous 14y agoPassword length and complexity aren't all that critical if it's salted and hashed. Unless your users' passwords are something like "password" or their user names. Password length and complexity are important, if overplayed.
- eksith 14y agoAh yes, well... if they're using 'password' for the password, they've got bigger problems ;) Passwords that can be guessed in 1-3 tries should be excluded, naturally: password, 12345, 11111 etc... But mixed case, special character stuff is a bit redundant.
- mergy 14y agoPretty sure the issue I had to deal with was related to the Java OSX exploit. That being said, it is a total trade-off vs. security or ease of use for the end-users.
- nradov 14y agoRequiring strong passwords doesn't help if users enter the same strong password on every site, and one of those sites is compromised in a way that exposes plain text passwords. This has happened many times in the last few years. Personally I use separate passwords for every site that matters, but there's no way to force users to do this.
- mergy 14y agoI haven't talked with the user involved besides trying to stop the bleeding, but it seems it was around the OSX java exploit on a BYOD mac laptop. You are totally correct though, I could do more to restrict this. But, if I can nuke the ip block because I will never get legit traffic from it anyway why not?