6 ms·
>CAPTCHA for login should just be outright illegal How do you prevent credential stuffing attacks? >especially if it blocks important functionality like closi
by gruez 8d ago
>CAPTCHA for login should just be outright illegal
How do you prevent credential stuffing attacks?
>especially if it blocks important functionality like closing your account.
That just falls under standard tort law, not to mention recent "click to cancel" legislation some states have been introducing.
- JoshTriplett 8d ago> How do you prevent credential stuffing attacks? CAPTCHAs don't work anymore, at this point. AI can trivially solve them. Rate-limit the number of attempts, test accounts against known-password lists like HIBP, and support 2FA.
- gruez 8d ago>CAPTCHAs don't work anymore, at this point. AI can trivially solve them. The point is to raise the cost, not to create some impenetrable barrier. A $5 vps can make hundreds of requests per second. IP bans and rate limiting forces people to use residential proxies, which are like $5/GB. That's much more expensive, but still cheap. Not sure about the token cost of AI is like, but captcha solving service used to charge around $0.002 per solve, which increases costs even more.
- GoblinSlayer 8d agoFor credential stuffing you need only one attempt.
- gruez 8d agoNo, it's a numbers game on both sides. Attackers are after hundreds or thousands of accounts, not just one. Defenders knows that exactly 0 hacks are impossible to achieve, and they're just trying to limit losses from fraud, but also costs from anti-fraud.
- GoblinSlayer 8d agoThey have so many accounts broken daily? Then credential stuffing attacks are not prevented.
- olyjohn 8d agoThen you don't need to automate it, and you can just manually solve the captcha and log in.
- bellowsgulch 8d agoThere is no raised cost anymore. Every professional doing this work has perfect alignment with regular consumer heuristics. OS, browser, fingerprinting, networked bytes, residential address spaces. All of it is done.
- nisegami 8d ago>How do you prevent credential stuffing attacks? Passkeys or magic links seem like the way forward here.
- hombre_fatal 8d agoYou can also randomly generate a password for the user on the form they'd normally type one in on registration. Add a "Regen" button to give users more visceral control over it before they submit the form.
- account42 8d agoThat's essentially the same as magic links because most users won't remember/save that password and will have to rely on the usually email-based reset flow.
- hombre_fatal 7d agoSure, but this subset of user was going to otherwise reuse their password and be susceptible to cred-stuffing. The point is to stop the attack and prevent users from accidentally hosing themselves.
- nisegami 7d agoIsn't that essentially a manual passkey?
- JoshTriplett 8d agoPlease don't. I find such services obnoxious, especially when they aggressively log you back out. Chasing down a link in your email is much slower than having your password manager fill in the long unique random password and hitting "log in".
- nisegami 7d ago>Chasing down a link in your email is much slower than having your password manager fill in the long unique random password and hitting "log in". That's basically a passkey without its special API.
- vablings 8d agoPasskey only. No passwords no usernames just passkey
- olyjohn 8d agoAt the minimum, stop using goddamn email addresses for the login.
- Plont 8d agoI'm not giving up recovery codes, nor my ability to default to locking out people who physically have my device. I usually don't allow auto-login or biometrics login either. If a website/app goes passkey only (or, even worse, if it starts relying only on one-time email codes), I won't use it. I know plenty of others who feel the same, though I don't know if we're numerous enough to put a dent in a company's bottom line or not. I imagine it depends on the company and its target audience.
- vablings 6d agoTwo passkeys. If you lose two then yeah, you are boned don't do that. They are absolutely the superior solution
- iambenm 8d agoRate limiting
- hombre_fatal 8d agoAttacks have been distributed for quite some time if your service has any loot worth attacking. You have to handle the case where every request comes from a unique IP address.
- toomuchtodo 8d agoPasswordless and passkeys. There are no credentials to stuff. Login with magic link, email OTP, passkey, etc. Get rid of the password, rate limit what remains.
- Plont 8d agoEmail OTP is garbage without the option to also add a password. That just outsources the problem to the user's email service, and assures that compromising the email inbox alone is enough to immediately also compromise every service that uses passwordless, 2FA-less "magic link" or OTP login. Email services don't even support true 2FA; many claim to, and ask for a 2FA code for web login, but connecting an email account to a client via POP or IMAP bypasses that.
- toomuchtodo 8d agoI implement customer identity and access management for millions of users in financial services, based on requirements driven in part by US federal regulatory and cyber insurance requirements. What’s your experience? > Email services don't even support true 2FA; many claim to, and ask for a 2FA code for web login, but connecting an email account to a client via POP or IMAP bypasses that. "In less than a year, passkeys have been used to authenticate people more than 1 billion times across over 400 million Google Accounts. Passkeys are easy to use and phishing resistant, only relying on a fingerprint, face scan or a pin making them 50% faster than passwords. In fact, on a daily basis passkeys are already used for authentication on Google Accounts more often than legacy forms of 2SV, such as SMS one-time passwords (OTPs) and app based OTPs (such as Authenticator apps) combined." https://blog.google/innovation-and-ai/technology/safety-security/google-passkeys-update-april-2024/ https://blog.google/innovation-and-ai/technology/safety-secu... (April 2024) Don't forget: Microsoft is killing passwords. How to set up a Microsoft passkey before August deadline. - https://mashable.com/article/microsoft-passkey-how-to-password-deadline https://mashable.com/article/microsoft-passkey-how-to-passwo... - June 20th, 2025 (All major email providers support either passkeys, or in the case of Microsoft, passwordless ["strong authentication"]; we can consider the user creating an app specific secret for an external mail client minimal risk if performed after strong authentication has occurred, as the odds are low of that secret being phished or exfiltrated once configured in their mail client of choice, for the few folks interested in such a user experience with web based email services)