Re:The Ripe NCC Has Run Out of IPv4 Addresses
by thefreeman on Monday November 25, 2019 @02:16PM
(#21631660)
2 is an interesting point. Let's say you want to rate limit login attempts to help reduce brute force attacks. How would you recommend doing it if not by ip? You can tie it to the specific username being requested but this has other downsides, ie. you can DOS someones account by sending fraudulent login attempts to it, and it also doesn't prevent attacks where people just test previously leaked username / password combos against your site.
[ Parent
| on HN ]
Re:The Ripe NCC Has Run Out of IPv4 Addresses
by xnyan on Monday November 25, 2019 @03:19PM
(#21632336)
Rate limiting by IP is trivial to work around. If you’re doing something white/grayhat there are plenty of services that will allow you to affordably "lease" as many IP addresswas as you need for very short amounts of time. For blackhat purposes it’s only slightly more effort and even cheaper to do the same thing, illegally of course.
Re:The Ripe NCC Has Run Out of IPv4 Addresses
by zAy0LfpBZLC8mAC on Monday November 25, 2019 @02:57PM
(#21632120)
> How would you recommend doing it if not by ip?
Not at all, it's a stupid idea. You are trying to nail down an identity without authentication, that can not work. If you use credentials with sufficiently high entropy, which you should do anyway, you don't have a problem that this could be the solution to.