4 ms·
But i still wouldnt know which request was genuine. Even worse. The genuine request might be filtered out! By doing this you make the DoS more effective actuall
by arianvanp 11y ago
But i still wouldnt know which request was genuine. Even worse. The genuine request might be filtered out! By doing this you make the DoS more effective actually.
- EGreg 11y agoI have never found a good solution to the trade-off of protection against brute-force vs availability. If I disallow X requests per second then I might enable DOS attacks on a user. What if a cluster of zombie machines around the world is attempting to log in as a politician to gmail at their publicly known address? How would the politician ever get in, if login attempts are rate limited?
- anaolykarpov 11y agothe rate limit can be per username/per ip address/per time period (you receive one notification once every 10 minutes), or a combination. Yes, when you have a botnet of a few thousands computers you could DoS someone. But with that in hand you can also DoS every web service on the internet (with a few exceptions)
- EGreg 11y agoBut sometimes DoSing an individual is more effective