11–20 of 45 posts
Rate limiting login attempts for an email address or ip address is all well and good for protecting against brute force attacks, but when the attacker has the correct email and password combination already for the user, and access to massively distributed botnets, how do you block those logins?
Somewhat related, but anyone have any best practices or can recommend a service to protect your users who have been pwned in another sites data breach? Rate limiting login attempts for an email address or ip address is all well and good for protecting against brute force attacks, but when the attacker has the correct email and password combination already for the user, and access to massively distributed botnets, how…
Earlier quoted context omitted.
Clever for sure. But I wonder how they can identify the leaked account even if they actively scan web / deep web. I mean it's not because Carlos Sanchez is for sale somewhere that it's my "insider".
Creator here – There are a few ways we can detect a breach/leak using our Insiders. 1. The unique email address assigned to the Insider is contacted. We gather forensic evidence of the email along with any attachments. Useful to identify specific attacks against your users too. 2. An optional real mobile number assigned to your Insider is contacted. Again, we store all of the details, including the original SMS detai…
Somewhat related, but anyone have any best practices or can recommend a service to protect your users who have been pwned in another sites data breach? Rate limiting login attempts for an email address or ip address is all well and good for protecting against brute force attacks, but when the attacker has the correct email and password combination already for the user, and access to massively distributed botnets, how…
Cool. Like canary passwords but for identities. Not enough use of canary passwords people!
Care to shed a bit more light on what you mean here and how to effectively use them?
Somewhat related, but anyone have any best practices or can recommend a service to protect your users who have been pwned in another sites data breach? Rate limiting login attempts for an email address or ip address is all well and good for protecting against brute force attacks, but when the attacker has the correct email and password combination already for the user, and access to massively distributed botnets, how…
I've read something about a method used by online banking services some time ago: They tracked the way the customer moves their mouse, calculated their arm lenghts etc. and when the movements were suspiciously different, the system assumes it's a fraud and logs them out.
It can also classify classes of users I.e. new portal users are moving mouse differently from users who are familiar with portal.
To add - by itself it’s not a reliable indicator of yes/no.
But rather another risk scoring input to overall identity detection system.
There's value here in detection of a breach that's already been monetized, but this isn't in the kill chain; it's long-after, so it appears reactive-only. Why should a non-massive company implement this rather than boosting and refining centralized logging and monitoring which can, if done right, provide far more immediate (even real time) notification of a breach? Your Wells Fargos of the world might do it because t…
For example disgruntled insider admin quietly stole all users data on his last day at work.
Somewhat related, but anyone have any best practices or can recommend a service to protect your users who have been pwned in another sites data breach? Rate limiting login attempts for an email address or ip address is all well and good for protecting against brute force attacks, but when the attacker has the correct email and password combination already for the user, and access to massively distributed botnets, how…
You email the account owner and tell them they've tried to login from somewhere new and ask for their permission to allow the login. If the email has already been pwned, then, well...I don't know, it's game over really.
So you need your system to check every spam email, call and text and decide whether it’s a breach or spam.