1015
Brute force protection (rytter.me)
submitted 2 years ago by to c/memes@lemmy.ml
103 comments fedilink hide all child comments
 

Brute force protection

@memes

you are viewing a single comment's thread
view the rest of the comments
[–] 9 points 2 years ago (4 children)

Not to be pedantic but wouldn't it be IsFirstLoginWithAttemptedPassword or am I missing something?

  • permalink
  • fedilink
  • source
  • hideshow 8 child comments
    •
  • [–] 7 points 2 years ago (1 child)

    no, since it first checks if the password is correct. if it is, display error message. if it is corrent and the second time, accept the password (code not in screenshot) but if the password is wrong, it doesnt check if it is the first attempt.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 2 years ago (2 children)

    How does that stop a brute force attack? As written, it only stops the single luckiest brute force attack that happens to get the password right on their first try.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 3 points 2 years ago

    You can't really prevent a brute force attack. Even if you prevent it from one IP or so, you can still do "distributed" brute force attacks.

    Also only allowing one password per 5 seconds or so per IP will not work if you have lots of users and they are at work and have the same IP.

  • permalink
  • fedilink
  • source
  • parent