Collaborate Disseminate
I’m considering the feasibility of a .onion domain for my website to cater to privacy conscious users.
Actions that occur before there’s a known UserID (eg. login page) need to have a bounded number of attempts to prevent bruteforce attack… Continue reading How do you rate limit bruteforce attempts on a Tor hidden service?
I have had multiple security researchers tell me that the best practice when a user changes their email in settings is to logout all other devices and force them to login again.
Nobody has been able to explain what attack this prevents or … Continue reading Should other devices be required to login again after an email change in settings?
I would like to implement a "Login from a suspicious location" email for my users.
The first thing that came to my mind was to use a GeoIP Latitude Longitude and a k-d tree to compare the distance
between the current login and th… Continue reading Suspicious login alerts vs customer privacy