Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

As described I don't really see how the solution proposed handles DoS attacks any better than a lock out after x failed attempts.

The key to preventing DoS attacks is that the throttling is specific to a given host so that when the genuine user attempts to log on (presumably from a different host than the attacker) they can do so without any throttling.



DoS meaning you can lock people out of their accounts, not that the site is brought down.


Which fails against any attacker with a botnet, so, solve the lockout problem first, and deal with DoS (which you can't ever really solve) later.


DoS is a different problem. That's about trying to soak up the entire bandwidth of your servers using lots of computers.

If you are throttling number of login attempts per account then it doesn't matter what the IP address being used is.




Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: