A brute force attack tries passwords systematically. Without protection, it’s only a matter of time before it succeeds.

Protection Mechanisms¶

• Rate limiting per IP and per account
• Progressive delays (exponential backoff)
• Account lockout after N attempts
• CAPTCHA after N failures
• MFA as the last line of defense

Implementation¶

Brute Force Prevention¶

async def login(username, password): attempts = await get_failed_attempts(username) if attempts > 5: delay = min(2 ** (attempts - 5), 300) # Max 5 min await asyncio.sleep(delay) if not verify_password(username, password): await increment_failed_attempts(username) raise AuthError(“Invalid credentials”) await reset_failed_attempts(username) return create_session(username)

Key Takeaway¶

Rate limiting + progressive delays + CAPTCHA + MFA. No single point of defense.