Brute Force Protection

Brute-Force nuq

Brute force attacks web applications Daq serious problem (bigger websites many users). attacker random username-password combinations user account compromise try pagh "wordlist" (typical usernames passwords: admin, 1234). lists quick succession Daq try, server return via login success recognize. theoretically brute force hypothetically password Hoch crack laH. question: password chay' poH Daq guess laH? attack 20 minutes attacker vaD acceptable; 500 years pagh. effective way: successful run time as long as possible. user login username exist tell Qo'. attack duration exorbitantly increase (attacker password 'ej valid username guess poQ). network platforms vaD less sensible (users other usernames legh laH). attacker valid account create 'ej other usernames tlhap (protection below). HTTP status codes via login verify pagh good approach. 403 code attacker intercept easy - login success information quickly tlhap, page parse poQ pagh (time gain vaD).

time span

https://tmedweb.tulane.edu/content_open/bfcalc.php exciting calculator: brute force attack duration 'ej combinations. password 5 uppercase, two lowercase, two numbers result: Your password is 9 characters long and has 803,181,017,600 combinations. It takes 15.58 hours or 0.65 days to crack your password on computer that trys 25,769,803,776 passwords per hour. This is based on a typical PC processor in 2007 and that the processor is under 10% load. 15.58 hours relatively little; attacker deter pagh. goal: time span extend (brute-forcing password reasonable pagh), user restrictions few.

protect chay'

Captcha

Captchas common protection brute force attacks against. login failures qaSDI' captcha show (additionally solve). advantage: user lock pagh, login laH; captcha solve poQ (accessibility problematic). captcha not always easy recognize (purpose) - users deter laH.

Secret Username

"Secret Username" (term official'a' Sovbe'): network platform Daq visible username login username pagh. alternatively user ID pagh mail address. misvam: social network Daq username David 'ej mail address "fancymail@d3vdav3.de". other users username (David) neH legh; login mail address "fancymail@d3vdav3.de" neH. attacker username 'ej password guess poQ - attack time increase.

Account lock

lock hard ways wa'. failed login attempts law' vaj account certain time lock. attacker 5 attempts qaSDI' 30 seconds wait - significantly longer time; easier target search. disadvantage: relatively simple DOS attack launch laH. attacker username Sov vaj 30 seconds interval wrong login attempts multiple - legitimate user login deny. legitimate user password forget vaj 30 seconds wait annoy.

Email verification

relatively easy efficient: further login attempts mail via unlock. failed attempts qaSDI' user mail link rap (click - account unlock). new attempt quickly, user wait pagh; brute force attempt information: several logins failed, password stronger choH.

Mouse movement

functional 'ach relatively ineffective: mouse movements intercept. user page navigate vaj mouse move poQ (input field pagh login button). mouse movement pagh user bot laH - captcha enter force. disadvantage: accessibility - TAB key navigation (mouse movement trigger pagh) user falsely bot identify. keyboard input check je sensible. 'ach Chromium keypress event trigger je - protection empty. professional attacker form via pagh, requests direct login script Daq POST request. protection empty again.

Two-factor

additional effective: one-time/time-based token (two-factor authentication). user 8-digit key (change after certain time, regenerate). key generation client-side 'ej server-side same seed - server entered key recompute validate. advantage: key 30 seconds change - brute force attack harder.

Login speed

login speed measure brute force avoid je. server-side time measure: user new login process start poQ time. legitimate user another password type vaj at least wa' second new attempt. client several login attempts per second - programmatically controlled, bot consider. several attempts short time vaj captcha additional validation, user inform, account lock certain time.

Login process delay

last possibility: login process delay. user data enter, server few seconds wait login execute qaSpa'. loading bar show (server request still process legh). login Hoch few seconds delay - successful brute force attack harder.

Result

absolute protection brute force against possible pagh. detect 'ej delay laH (time span success Dung large - attack run uneconomical). several methods combine best, user-friendliness 'ej security Dung balance.