Credential Attacks

Throttle Authentication Attempts Without Locking Out Users

Password authentication exposes a public decision point: a client submits a claimed identity and a secret, then the server accepts or rejects the pair. Attackers can automate that decision point at a scale no human user can match. A simple request limit helps, but authentication traffic has unusual constraints. A limit tied only to an IP address can punish thousands of legitimate users behind one gateway. A limit tied only to an account lets an attacker deliberately block a victim from signing in. A permanent account lock can turn a guessing defense into a denial-of-service primitive.