1

We have implemented in our mobile application a rate limiting access after 5 failed attempts though a web based services (API). We lock down the account for 30 mins if the fives attempts have been performed.

My concern is about the customers who are using the app.. what if someone tried to run a script that will try to brute forcing and keep the lock the customers from using the application (30 mins).

Is there any solution than can be applied in this case.. as Captcha will not be because its an mobile application.

Improve this question

1 Answer 1

Reset to default
1

You can use Proof of Work to limit the speed at which brute force programs can try to login. This is a user-friendly alternative to CAPTCHA

Proof of Work requires the client calculate the prime factors of a very large number, and this takes time

Send the large number to the client. If they don't provide any answer, immediate NO. If they provide an answer, it's fast to check on the server. If they pass, let the login attempt proceed

You can also use a device cookie to bypass account lockouts. For example, if client C has previously successfully authenticated for user U, store an HMAC'd cookie on client C . Having this cookie lets that client bypass account lockouts for that username.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .