Timeline for Is it good practice to ban an IP address if too many login attempts are made from it?
Current License: CC BY-SA 3.0
21 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 25, 2015 at 16:53 | answer | added | mozzbozz | timeline score: 1 | |
| Feb 16, 2015 at 3:37 | answer | added | Pacerier | timeline score: 0 | |
| Jun 4, 2014 at 7:36 | vote | accept | Levite | ||
| Jun 2, 2014 at 15:03 | vote | accept | Levite | ||
| Jun 2, 2014 at 15:03 | |||||
| May 29, 2014 at 6:38 | comment | added | Rory McCune | @voo yeah I'm aware of TCP sequence predication but that hasn't been a practical threat in ages, that said I hadn't seen that CVE before, but from reading the mailing list posts they're still talking about 24-bits of randomness which would be a hell of a lot of packets to make a single HTTP request even with a vulnerable system. | |
| May 28, 2014 at 14:12 | comment | added | Levite | The EXTERNAL IP might be the same for a whole university for example, while the computers in the network have their own individual internal IP addresses. But that's not the point here, also this login requires SSL, so IP spoofing should also be pretty much off the table (albeit distributed attacks might bring up similar problems...) | |
| May 28, 2014 at 13:37 | comment | added | TylerH | Since when can a single IP address cannot represent a whole company/network? I don't think that's how they work. | |
| May 28, 2014 at 11:28 | comment | added | ratchet freak | @voo then don't allow TCP but enforce HTTPS for log-in | |
| May 28, 2014 at 10:25 | comment | added | Voo | @Roy If the initial sequence number is predictable, the whole handshake is predictable. But apparently that did get better over the years. But see here for what I meant. | |
| May 28, 2014 at 8:06 | comment | added | Rory McCune | @voo I'd agree with Lucas, you'll need to provide more details to substantiate that claim. Spoofing IP addresses for TCP based protocols (e.g. HTTP) is quite difficult in most cases. | |
| May 28, 2014 at 8:04 | comment | added | Lucas Kauffman | @Voo how would you spoof an IP using TCP. This is not possible as there is no way to complete your three-way handshake succesfully. The only way you'd be even reomtely able to do this is by abusing a botnet. But even then the amount of IPs will be relatively limited. | |
| May 28, 2014 at 7:56 | comment | added | Nzall | You might want to consider using time between attempts in addition to rate. a legitimate user needs time to enter his username and password and wait for a response. someone using an automated process doesn't really need that. And if they know you're doing this and throttle their requests to look like regular user traffic, it'll be less like a DDOS attack and more like a busy day, something your servers should be able to handle. | |
| May 28, 2014 at 4:41 | comment | added | Pharap | How would you define 'too many'? Also, if you enforce such a restriction then you need to make users aware in case they are trying to remember their password and would rather keep trying different passwords than ask for an email reminder (asking for an email reminder is like stopping and asking for directions - some people just won't do it). | |
| May 27, 2014 at 22:19 | comment | added | Voo | Don't forget the simple fact that I can easily (sadly really) spoof my IP address and get you to block IPs despite not having any access to it. Depending on your use case such a DDOS attack may be problematic or not. | |
| S May 27, 2014 at 19:43 | history | suggested | Freiheit | CC BY-SA 3.0 |
spelling in title and question
|
| May 27, 2014 at 19:38 | review | Suggested edits | |||
| S May 27, 2014 at 19:43 | |||||
| May 27, 2014 at 16:53 | answer | added | thomij | timeline score: 14 | |
| May 27, 2014 at 16:39 | history | tweeted | twitter.com/#!/StackSecurity/status/471329910293020672 | ||
| May 27, 2014 at 14:02 | answer | added | Rory McCune | timeline score: 68 | |
| May 27, 2014 at 13:54 | history | edited | Levite |
edited tags
|
|
| May 27, 2014 at 13:40 | history | asked | Levite | CC BY-SA 3.0 |