Excessive Failed Login Attempts
Excessive failed login attempts without limits allow attackers to brute-force passwords or run credential stuffing.
Purpose
To understand the brute-force risk caused by missing rate limits and their defenses; a core concern of authentication security.
Mechanism
Attackers repeatedly try passwords with no lockout or delay. Defenses: lockout after failed counts, exponential backoff, CAPTCHA, IP rate limiting, credential-stuffing detection (comparison against known leaked passwords).
Use cases
- Brute-force defense
- Rate limiting
- Account lockout policy