Authentication
Authentication proves who a user or a service is, with a password, a code, a key or a token. A 6-digit code has only 1,000,000 values, so unlimited tries find it fast. A limit of 1 guess per second for each account makes a full search take about 12 days.
See it on the board
The same traffic runs on two boards. The simulator measured both when this page was built.
| Measure | Goal | One shared limit of 1,000 requests/s | Limit of 1 guess/s for each email, burst 2 |
|---|---|---|---|
| Throughput (Guesses) | under 20 req/s | 525 req/s Fail | 4 req/s Pass |
| Error rate (Codes) | under 0.5% | 0% Pass | 0% Pass |
| p99 latency (Codes) | under 150 ms | 115 ms Pass | 73 ms Pass |
| Monthly cost | 16 USD/mo | 16 USD/mo |
Key numbers
| Number | Value |
|---|---|
| Rate limit check, median | 0.1 ms |
| Requests per second a rate limiter allows, default | 10,000 req/s |
| Extra requests a rate limiter allows at once, default | 1,000 requests |
| Lifetime of a sign-in token, default | 3,600 s |
Limit 1/s per account · all codes tried in 12 days
How it works
Each request must first answer one question: who sends it. A person proves it with something they know, such as a password, or something they have, such as a phone that gets a code. A service proves it with a key, a certificate or a signed token.
After the first check, the system gives a session or a token, so the user does not prove it again on each request. A short token lifetime limits the damage when a token is stolen, but the client must renew it more often. A way to revoke tokens lets you end a session at once.
Each check that accepts a secret is a target for guesses. A short code or a weak password falls fast to an attacker who can try without limit. Limit the tries for each target account, not only for each sender address, because a botnet uses thousands of addresses. Give the same answer for a known and an unknown account, so that the answer does not show which accounts exist.
Keep passwords only as slow, salted hashes. With a fast hash, an attacker who steals the table can test billions of passwords each second.
In the levels you limit guesses and keep real users able to sign in.