We see these kinds of attempts with some frequency. Normally a leak has happened from some other 3rd party, and an attacker has a big list of known account + password combinations that they can try against other systems. They then hit our system (in this case, a website login form) testing all the credentials they have for a match.

Given that people are unreliable at using unique credentials, and that not everyone on our platform has opted in to using 2FA (and we don't want to force it), are there additional steps we can be taking to help protect users, or efforts we can undertake to combat being used as a testing ground for leaked lists?

(It's also very annoying having to scale up large numbers of instances because some attacker is throwing vast numbers of concurrent attempts per second at our infrastructure!)

Obvious precautions we already implement:

  • Rate limiting attempts per account, combined with a temporary lockout, but that doesn't help against a list of single entries.
  • Rate limiting attempts per IP address, but that doesn't stop when the testing is distributed over a large number of nodes. Typically we see enumerations happening from 5k+ addresses, and that means at least 25k accounts can be tested before we start filtering those addresses.

We are evaluating the idea of using email confirmations as 2FA (for users not opt-ed in to using a 2FA device with us), when we see a login from a device we don't know, but we will first need to measure the customer impact.

Can (and should) we be undertaking further efforts to protect users?

1 Answer 1


Strongly consider converting to 2FA emails for first-time computer registration.

"Dear Andy Savage, we've noticed this is the first time you've used this browser to log in to our service. To help keep your account safe, we've sent an email to your registered email address at a****e@g****.com. Please click the link in the email to confirm this really is you."

Most of your customers have already received a dozen such letters, and will barely notice the "inconvenience" you're imagining. If they bother to consider it, they might believe you're doing some magical security things that they don't understand, or they might think you're just blowing fake security smoke at them. And yes, some will be confused and/or frightened because it's not what they expect. You can minimize that by gathering existing login info now, and pre-setting cookies on all their existing browsers today so that they never even see the prompt.

Whatever fallout you get from this will pale in comparison to the blame you will receive for any Account Take-Overs that happen. It's one thing to confuse them, but they'll have a completely different reaction if they think that you were hacked or you allowed them to be hacked (hint: most clients can't or won't make the distinction.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .