https://nalar.dev/tags/credential-attacks/ Recent content in Credential Attacks on Nalar Hugo en-us Sat, 12 Sep 2026 00:00:00 +0700 https://nalar.dev/throttle-authentication-attempts-without-locking-out-users/ Sat, 12 Sep 2026 00:00:00 +0700 https://nalar.dev/throttle-authentication-attempts-without-locking-out-users/ <p>Password authentication exposes a public decision point: a client submits a claimed identity and a secret, then the server accepts or rejects the pair. Attackers can automate that decision point at a scale no human user can match.</p> <p>A simple request limit helps, but authentication traffic has unusual constraints. A limit tied only to an IP address can punish thousands of legitimate users behind one gateway. A limit tied only to an account lets an attacker deliberately block a victim from signing in. A permanent account lock can turn a guessing defense into a denial-of-service primitive.</p>