Weak passwords brute forced

Re:Weak passwords brute forced by evanspa on Tuesday November 19, 2013 @11:16PM (#6766259)

See "Part VII" of this SO answer from Jeff Atwood describing mitigation techniques for "distributed brute force attacks"

http://stackoverflow.com/questions/549/the-definitive-guide-...

TL;DR - compute the average number of system-wide failed password attempts, and if it's over the norm, impose small delay on all users (except those that login via a persistent login cookie).

[ Parent | on HN ]

Re:Weak passwords brute forced by jakobe on Wednesday November 20, 2013 @01:19AM (#6766603)

Actually, this answer isn't by Jeff Atwood. See http://meta.stackoverflow.com/questions/95172/old-problemati...

[ Parent | on HN ]

Re:Weak passwords brute forced by evanspa on Wednesday November 20, 2013 @09:56AM (#6768320)

Ah - my mistake. Thank you for clarifying.

[ Parent | on HN ]

Re:Weak passwords brute forced by ohwp on Wednesday November 20, 2013 @03:47AM (#6766989)

Note that this can be very tricky. You don't want to keep connections open or waiting.

[ Parent | on HN ]

Re:Weak passwords brute forced by rurounijones on Tuesday November 19, 2013 @11:48PM (#6766359)

Very useful, thanks!

[ Parent | on HN ]