Instagram story viewer> @ohdecepcion> Post

Oh! Decepción

@ohdecepcion

2 years ago

41

1

Posted On: December 26th 2024, 07:16 am

Tagged Users:

@taylorswift

@heberbaez.n

@alex.varom

@francisco_castillo_24

francisco_castillo_24

YA ES MAÑANAAAA 🗣️ Mañana los esperamos emo plebes 26 de Diciembre plaza principal de Cerritos S.L.P. en punto de las 9 pm 🫵🏻 #emo #punk #chi

Comments (1)

the.drumless

2 years ago

the.drumless

🔥🔥🔥

More posts

Jai Durga Maa🙌🏻❤️

#durgapooja #tanishamukerjee #instantbollywood #sk

All black. All class. All glory to God. 🖤✨ BRABUS #G63AMG #BlackOnBlack #MercedesAMG #blessedbeyondmeasure

🚨 Interview question: 10,000 bots are hammering your login API. How do you stop them without locking out real users?
Most people say "just block them." Here's why that fails 👇
❌ Blocking IPs doesn't work. The bots come from thousands of different IPs, each sending only a few requests, so no single source looks suspicious.
❌ Login is expensive on purpose. bcrypt is deliberately slow so attackers can't guess passwords quickly. But that means every fake attempt burns real CPU, and enough of them turns an attack into an outage.
❌ Rate limits don't catch it. Attackers use email and password pairs leaked from other sites, with only 1-2 tries per account. Your "5 attempts" rule never triggers.
❌ Lockouts backfire. Now attackers can lock real users out on purpose.
✅ The real fix: decide earlier. Put a cheap risk check in front of the expensive one, and only spend CPU on requests that look real.
What the risk check looks at:
🔹 TLS fingerprint: a real iPhone app and a Python script connect differently, even if both claim to be an iPhone
🔹 Failure rate: a client failing most of its logins is suspicious
🔹 Known device: have we seen this device before?
No single signal is enough, so you combine them and respond in proportion:
🟢 Low risk → straight through
🟡 Medium risk → CAPTCHA
🔴 High risk → dropped before it touches bcrypt
Real users barely notice. Bots get expensive. 💸
Interview answer in one line: score each request cheaply, challenge the doubtful ones, and protect the slow, expensive step behind them.
📌 Save this for your next system design interview
💬 Comment "SECURITY" if you want the next one on rate limiting
➕ Follow for more backend concepts explained visually
Hashtags:
#systemdesign #softwareengineering #backend #cybersecurity #codinginterview techinterview programming developer bcrypt webdevelopment learncoding computerscience botprotection apidesign tech

د.أنجي قصابية : بأخد 78 حبّة مكمّل غذائي باليوم وخلايا جذعية للمبايض #حلم_وصار الحلقة الكاملة في اللينك في ال Bio👆

Thank you for the warm welcome, @sombr ♥️🙏

Apa pendapat lo soal prediksi Elon Musk ini?

#elonmusk #AI #artificalintelligence #tradewithsuli