Brute force útok zkouší hesla systematicky. Bez ochrany je otázkou času, kdy uspěje.
Ochranné mechanismy¶
- Rate limiting per IP a per účet
- Progressive delays (exponential backoff)
- Account lockout po N pokusech
- CAPTCHA po N neúspěších
- MFA jako poslední obrana
Implementation¶
Python — progressive delay¶
async def login(username, password): attempts = await get_failed_attempts(username) if attempts > 5: delay = min(2 ** (attempts - 5), 300) # Max 5 min await asyncio.sleep(delay) if not verify_password(username, password): await increment_failed_attempts(username) raise AuthError(“Invalid credentials”) await reset_failed_attempts(username) return create_session(username)
Key Takeaway¶
Rate limiting + progressive delays + CAPTCHA + MFA. Žádný single point of defense.
securitybrute forceautentizace