Timeline for Can anti-CSRF token prevent bruteforce attack?
Current License: CC BY-SA 3.0
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Sep 21, 2014 at 19:38 | comment | added | PwdRsch | A captcha is a proper defense, it is just one that can be circumvented by either applying the right technology (e.g. script that can accurately OCR the characters) or manual human effort. Not all attackers are capable or willing to do that. Same goes for scripting in the retrieval of a CSRF token before password guessing, albeit that requirement is much easier to overcome. | |
| Sep 21, 2014 at 6:10 | comment | added | lzam | And something like fail2ban, and, considering that the attacker may have a large number of IP addresses at his disposal, temporary account lockouts (regardless of IP address) after too many failed login attempts. This latter measure can be exploited to create a DoS attack though. | |
| Sep 21, 2014 at 5:17 | history | edited | rook | CC BY-SA 3.0 |
added 30 characters in body
|
| Sep 21, 2014 at 3:51 | history | answered | rook | CC BY-SA 3.0 |