Locking down logins

Hacker's handbook • 3 min read

A login form is a public invitation to guess. Attackers don't type guesses by hand: they run software that tries thousands of username and password pairs, around the clock, against every login page it can find. Most of those pairs aren't guesses at all. They're real passwords, stolen from other sites, tried again on yours in the hope that someone reused one.

How logins are attacked

Credential stuffing: lists of email and password pairs leaked from other sites are replayed against your login. It works because people reuse passwords.
Password spraying: a few very common passwords are tried against many accounts, slowly enough to stay under per-account limits.
Brute force: many passwords are tried against one account, usually an admin.
Phishing: a convincing copy of your login page collects the password directly. AI has made these messages and pages much harder to tell from the real thing.
Reset abuse: the "forgot password" flow is attacked instead of the login, because it's often the weaker of the two.

Slow the guessing down

Limit attempts per account and per address. One limit alone isn't enough: spraying stays under a per-account limit, and a botnet stays under a per-address limit.
Increase the delay after each failure rather than locking the account outright. A hard lockout lets an attacker lock your real users out on purpose.
Apply the same limits everywhere a password is checked, including the API, the mobile endpoint, and any older login path that still works.

Make a stolen password useless

Require a second factor for admin accounts at the very least, and offer it to everyone. An authenticator app or a security key stops most attacks that depend on a password alone.
Reject known-leaked passwords when people choose one. Lists of breached passwords are public, and attackers try those first.
Allow long passwords and password managers. Don't block pasting, and don't force regular changes without a reason, which only produces weaker passwords.

Keep admin logins out of reach

The login that matters most should be the hardest to find. If only your team uses it, the public doesn't need to see it at all.

Put it behind a VPN or single sign-on, so the form isn't reachable from the open internet.
Remove default accounts such as admin, and never leave a default password in place.
Give each person their own account. Shared logins can't be traced or revoked one person at a time.

The details that leak

Use one error message: "Incorrect email or password" for both cases. Different messages tell an attacker which accounts exist.
Do the same on sign-up and reset: "If that address has an account, we've sent an email" reveals nothing.
Make reset links single-use and short-lived, and end other sessions when a password changes.
End sessions properly: signing out should invalidate the session on the server, not just delete the cookie.

Watch for it

Login attacks are noisy if you're looking. A sudden rise in failed sign-ins, many accounts tried from one address, or successful sign-ins from unusual places are all worth an alert. Tell users when their account is accessed from a new device, so they can raise the alarm themselves.

Conclusion

Assume your users' passwords are already on a list somewhere. Limit how fast anyone can guess, add a second factor so a correct password isn't enough, keep admin logins off the public internet, and watch the failures. Each step is small, and together they turn your login from the easiest way in to one of the hardest.