Rate Limiting, Quotas & Abuse Protection · Abuse Protection and Operations
Defending Login and Account Endpoints
Credential stuffing, brute force, OTP abuse and account enumeration.
Attackers replay leaked credentials from many IPs (credential stuffing), guess passwords (brute force), abuse OTP/SMS endpoints and probe for valid accounts (enumeration). Layer defenses: per-IP and per-account limits on failures, progressive delays or challenges (CAPTCHA/Turnstile) instead of hard lockouts, breached-password checks, MFA/passkeys, identical responses for unknown accounts, device/IP reputation and anomaly alerts.
Account attacks and controls
| Attack | Signal | Control |
|---|---|---|
| Credential stuffing | Many accounts, many IPs, high failure ratio | Bot detection, breached-password checks, MFA, challenges |
| Brute force (one account) | Many failures on one account | Per-account limits, progressive delay |
| Password spraying | Few attempts per account, many accounts | Global failure-rate anomaly detection |
| Enumeration | Probing signup/reset with many emails | Identical responses + limits |
| SMS pumping | OTP to premium/foreign numbers | Per-phone/country limits, allow-lists |
Common pitfalls
- Hard lockouts (attackers lock out victims).
- Different error messages for unknown accounts.
- Limits only per IP (distributed attacks bypass them).
Key points
- Per-IP + per-account + global anomaly limits
- Challenges over lockouts
- MFA and breached-password checks
Further reading: OWASP: Credential stuffing
Practice questions
Why is password spraying hard to stop with per-account limits?
Answer
Attackers try one or two common passwords per account across many accounts, staying under per-account thresholds; you need global failure-rate monitoring and breached-password defenses.
Why prefer progressive challenges over account lockout?
Answer
Lockouts let attackers deny service to real users; challenges and delays slow automated attacks while legitimate users can still proceed.
Open in the app to mark lessons complete, take notes and track your progress.