Timeline for Prevent a bot accessing login page with multiple IPs and massive list of username/ passwords
Current License: CC BY-SA 4.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 28, 2020 at 10:50 | comment | added | Simon Richter | In that case I concur with @Logronoide that it's an attack that is trying out user passwords from leaked lists. If you have regular newsletters, you can add a note reminding users that they should use a different password on every service they subscribe to. | |
| Aug 28, 2020 at 10:44 | comment | added | contool | It's a good point. I just had a look and it seems that every user email is only attempted once and no-one was locked out thankfully. There's actually only a fairly small overlap between attempted logins and real user emails. It seems they've "acquired" a list of real email/password combos from somewhere and are trying their luck. I'd say I'm not the only target for this, just unlucky | |
| Aug 28, 2020 at 9:32 | comment | added | Simon Richter | @contool, from the availablity point of view, there is absolutely an issue if I can lock other people's accounts permanently if I only know their email address. If I wanted to make it look like an accident, I'd probably spam a few million unrelated authentication requests at the same time -- that's why I suggested looking at whether any valid accounts got locked as a result of this. | |
| Aug 28, 2020 at 9:30 | comment | added | Simon Richter | @contool, not from a confidentiality point of view (except if the captcha somehow behaves differently between valid and invalid accounts -- does an invalid user name also get captchas on the fourth and fifth attempts? | |
| Aug 28, 2020 at 8:19 | comment | added | contool | Technically no, it would be 4 because the captcha resets after the 30 min wait (5th attempt). However we don't expose emails, failed attempts and password resets don't confirm an email match. Do you think there's an issue here? | |
| Aug 27, 2020 at 21:08 | comment | added | Simon Richter | @contool, so if my goal is to get a particular account permanently locked rather than gain access to it, and I know just the email address, I have to solve seven captchas to do that? | |
| Aug 27, 2020 at 20:38 | comment | added | contool | yep - I lready have this in the system. Captcha after 3 attempts, half hour lock after 5, complete account lock after 10. They're using millions of different emails, most of them not even in my system. | |
| Aug 27, 2020 at 17:26 | history | answered | Simon Richter | CC BY-SA 4.0 |