Home/ Questions/Q 804929
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-14T23:59:52+00:00

What’s the best way to prevent a dictionary attack? I’ve thought up several implementations

  • 0

What’s the best way to prevent a dictionary attack? I’ve thought up several implementations but they all seem to have some flaw in them:

  1. Lock out a user after X failed login attempts. Problem: easy to turn into a denial of service attack, locking out many users in a short amount of time.
  2. Incrementally increase response time per failed login attempt on a username. Problem: dictionary attacks might use the same password but different usernames.
  3. Incrementally increase response time per failed login attempt from an IP address. Problem: easy to get around by spoofing IP address.
  4. Incrementally increase response time per failed login attempt within a session. Problem: easy to get around by creating a dictionary attack that fires up a new session on each attempt.
Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I like gmail’s anti-brute force system a lot. It is based on “heat” that a user can accumulate, after the user has overheated they are prompted with a captcha. You can keep track of heat using a sql database, or using redis incr. Heat is assigned to an ip address. It is 100% impossible to “spoof” a tcp connection over the internet because of the three-way-handshake, however proxy servers are plentiful and ip address are very cheap. Proxy servers are commonly used to send spam, you can check a blacklist and automatically prompt them for a captcha.

    Each bad action against your system will update the heat table. For instance a failed login will accumulate 35% heat. Once the heat level is greater than or equal to 100% then the user is forced to solve a captcha. Solving a captcha will “cool down” that ip address. The heat table could contain a timestamp column that is set to the current time on update. After 24 hours or so the heat can return to 0.

    reCaptcha is the most secure captcha you can use.

    • 0