3 ms·
The attack was done using 40,000 IP addresses. You can only force a timer per IP address.
by jcampbell1 13y ago
The attack was done using 40,000 IP addresses. You can only force a timer per IP address.
- muglug 13y agoYou can also force a timer on a per-account basis - e.g. twenty failed logins for one account from five different IP addresses -> set a timer on those IP addresses and a timer on that account. It's not simple, but it would help mitigate a mass-brute-force effort.
- schrodinger 13y agoBut then it's trivial to lock someone out of their account by trying to login as them a bunch of times. That's why they'd key it based on ip and username, not ip alone.