More information about the Underscore mailing list

[_] Passwords & security

Russ Ferriday rf at sponsorcraft.com
Mon Feb 18 15:07:47 GMT 2013

Denial of service?

Russ Ferriday
CTO Sponsorcraft.com
M: +44 7429 518822
Skype: ferriday

On 18 Feb 2013, at 15:06, Steve James <us.redpumas at gmail.com> wrote:

> I wasn't thinking of blocking on the IP as that would block other
> users etc. But block logins to the particular user id.
> 
> Steve
> 
> On 18 February 2013 14:49, Tim Wintle <timwintle at gmail.com> wrote:
>> On Mon, 2013-02-18 at 14:38 +0000, Paul Harwood wrote:
>>> But wouldn't your brute hacker then also block genuine access?
>> 
>> [Assuming you are fine with the concurrency restrictions imposed by
>> having shared state between authentication servers] you can block
>> specific IP addresses after X attempts.
>> 
>> However this won't stop a dedicated team (e.g. government sponsored)
>> trying to brute force it, who can either iterate through an entire
>> subnet (think there aren't entire multiple malicious /16 subnets out
>> there?), botnets, or more advanced network tricks to get around those
>> filters.
>> 
>> 
>> Tim
>> 
>>> 
>>> -- Paul
>>> 
>>> 
>>> On 18 Feb 2013, at 13:41, Steve James <us.redpumas at gmail.com> wrote:
>>> 
>>>> But why should this matter?
>>>> 
>>>> block logins to that user after say 10 attempts for half an hour.
>>>> 
>>>> How long would it take to brute force then?
>> 
>> 
>> 
>> --
>> underscore_ list info/archive -> http://www.under-score.org.uk/mailman/listinfo/underscore
> 
> -- 
> underscore_ list info/archive -> http://www.under-score.org.uk/mailman/listinfo/underscore