Instagram story viewer> @daisyfranchetto> Post

Daisy Franchetto

@daisyfranchetto

a month ago

Co Creator:

darkzone0

🤩Grazie a Lidia Simonetti di Inizio a Scrivere per avermi ospitata 🙏

Link nella storia⭐️

#DZedizioni #aguaploma #intervista #Youtube

14

1

Posted On: September 21st 2026, 08:00 am

Tagged Users:

@darkzone0

@creativita_che_passione00

creativita_che_passione00

🤩Grazie a Lidia Simonetti di Inizio a Scrivere per avermi ospitata 🙏

Link nella storia⭐️

#DZedizioni #aguaploma #intervista #Youtube

Comments (1)

creativita_che_passione00

a month ago

creativita_che_passione00

Grazie a te🔥

More posts

Ferguson Rifle VS Hall Rifle

Help us wish Lauren a happy birthday!! 🥳

Too free to be tamed, too happy to be bothered, too busy living to explain.🔥❤️✨

#thailand #travel #artist #happylife #peace

The new two-part docuseries about Melania Trump is dropping this November! 🍿

🚨 Interview question: 10,000 bots are hammering your login API. How do you stop them without locking out real users?
Most people say "just block them." Here's why that fails 👇
❌ Blocking IPs doesn't work. The bots come from thousands of different IPs, each sending only a few requests, so no single source looks suspicious.
❌ Login is expensive on purpose. bcrypt is deliberately slow so attackers can't guess passwords quickly. But that means every fake attempt burns real CPU, and enough of them turns an attack into an outage.
❌ Rate limits don't catch it. Attackers use email and password pairs leaked from other sites, with only 1-2 tries per account. Your "5 attempts" rule never triggers.
❌ Lockouts backfire. Now attackers can lock real users out on purpose.
✅ The real fix: decide earlier. Put a cheap risk check in front of the expensive one, and only spend CPU on requests that look real.
What the risk check looks at:
🔹 TLS fingerprint: a real iPhone app and a Python script connect differently, even if both claim to be an iPhone
🔹 Failure rate: a client failing most of its logins is suspicious
🔹 Known device: have we seen this device before?
No single signal is enough, so you combine them and respond in proportion:
🟢 Low risk → straight through
🟡 Medium risk → CAPTCHA
🔴 High risk → dropped before it touches bcrypt
Real users barely notice. Bots get expensive. 💸
Interview answer in one line: score each request cheaply, challenge the doubtful ones, and protect the slow, expensive step behind them.
📌 Save this for your next system design interview
💬 Comment "SECURITY" if you want the next one on rate limiting
➕ Follow for more backend concepts explained visually
Hashtags:
#systemdesign #softwareengineering #backend #cybersecurity #codinginterview techinterview programming developer bcrypt webdevelopment learncoding computerscience botprotection apidesign tech