View Single Post

  #2 (permalink)  
Old 06-30-2003
Alan J. Flavell
 
Posts: n/a
Default Re: Apache limit number of login retries

On Mon, Jun 30, Ralph Mengen inscribed on the eternal scroll:

> We use this not-so-expensive solution and are a satisfied customer:


This is a technical discussion group. Wouldn't you be willing to
at least sketch out the working principle, and address how it deals
with the obvious issues?

Two things immediately strike me:

1. Since it says it does its blocking per-IP, any serious attacker
would simply get themselves a list of open HTTP proxies, of which
there are many thousands on the 'net, and work via those.

2. when users access the web from behind a cache proxy, as they do at
quite a number of major ISPs as well as from some proportion of
educational campuses for example, it only takes one mischief maker to
block the access for all the other users of the same cache.

cheers