Designing a service for password-less temporary access to resources

Post by dahfizz » Sun, Dec 29, 2019, 3:57 AM UTC

NicoJuicy wrote: post #15

rafd wrote: post #5

6 characters is pretty trivial to brute force. Someone could set up a script to continuously try all combinations and get access to whatever happens to hit a match. You could block an IP after a certain number of failures, but that doesn't protect against a network of various IPs attacking (which attackers often have access to). Adding an artificial delay also wouldn't protect against parallel attacks. A simpler/bett…

Why an IP block instead of a username block

Post by skunkworker » Sun, Dec 29, 2019, 7:21 AM UTC

reaperducer wrote: post #2

Each shortcode is 6 characters and is case insensitive. That gives us roughly 1.8 billion (1838265625) combinations. That's only 1.8 billion combinations if you only have computers talking privately to other computers. But in the scenario outlined in the article, people will see the URL, so you must filter millions of those combinations. For example, if I come across a recipe for shoo-fly pie, I don't want to forward…