1

When temporarily blocking a client by IP address making to many login attempts, what are the security implications of only restricting them from attempting the same login email/username again for a short time?

This would severely limit the impact of a DoS attack, usually other machines on the same network also be limited, this method would only restrict access to the attempted accounts.

The implementation would have to restrict attempts even to user credentials not in your system to avoid user enumeration.

  • 1
    Still vulnerable to DoS attack. Just target multiple usernames instead of a single account. – Future Security Feb 1 at 4:20
1

The secuirty measure would simply be a joke then and you would be litereally wasting space and code(if the attack is against a login such as spotify or something as large. A forum maybe?) People have became witty about how they conduct these attacks. Taking combinations of user:pass or email:pass and using these to login while using HTTP/HTTPS high level anonimity proxies. Also refered to as credential stuffing. This is a very effective attack method. As for targeting one user account. They better just have a lot of proxies and a script that identifys whether the proxy has been banned and uses a different one.

  • litereally wasting space and code They better just have a lot of proxies and a script that identifys whether the proxy has been banned and uses a different one. Your example is the same for normal IP resource throttling, it's not really related to my suggestion. Slowing requests to endpoints down is better than no restrictions at all. – Necro Feb 1 at 3:06
  • I'm sorry i'm not sure what you're asking then is there a better way to elaborate it? – J Doe Feb 1 at 3:11
  • 1
    What are the additional risks incurred by allowing an attacker to have 10 attempts at whatever username or email they wish to. Because originally they were only allowed to try 10 times maximum. – Necro Feb 1 at 3:23
  • What I ment by 'They better just have a lot of proxies and a script that identifys whether the proxy has been banned and uses a different one.' is that allowing 10 maximum attempts a user could have a proxy per attempt. Having an additional ip allows ten more attempts. Outside of that there is no additional risks depending on the time set to unban. My post on credential stuffing was simply meaning that in that attack vector 10 maximum attempts is out of question because you're targeting one login with one password unless several instances of the same account exist in that combination file. – J Doe Feb 1 at 3:29
  • Thank you, i am accepting your answer based on your follow up comments Outside of that there is no additional risks depending on the time set to unban – Necro Feb 1 at 4:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.