Cualquier pantalla de acceso que esté en internet recibe, desde el primer día, intentos automáticos de contraseña: robots que prueban listas enteras de usuarios y contraseñas filtradas de otros sitios, a cientos por minuto. No van a por ti; van a por cualquiera. Si la pantalla no se defiende, tarde o temprano aciertan con la contraseña de alguien que la reutilizaba.
Simplio frena los intentos repetidos y, si una dirección insiste, la bloquea. La dirección bloqueada no recibe ninguna pista: ni "contraseña incorrecta", ni "usuario no existe", ni "estás bloqueado". Simplemente no entra. El operador ve las direcciones bloqueadas en una lista y desbloquea la que haga falta, por ejemplo la oficina de un cliente al que se le atascó la tecla.
How it works
Failed attempts are counted per address
Every wrong password counts. A human mistake is nothing; a burst is.
If it persists, the address is blocked
No warning or explanation to the outside. The bot doesn't know whether the password was good, whether the user exists or whether it's blocked.
The operator sees it and undoes it if needed
List of blocked addresses, with date and number of attempts, and a button to unblock.
How secure it is
No clues
Error messages don't distinguish between a nonexistent user, a wrong password and a blocked address. No information is given away to whoever is attacking.
Two-factor is still behind it
Even if a bot guessed a password, the phone code would stop it. Blocking is the first layer, not the only one.
The same task, in AWS and in Simplio
| On your own in AWS | In Simplio | |
|---|---|---|
| Stop bots on your own sign-in page | Code it yourself, or put a WAF with rate rules in front | Included |
| See who is blocked | Read the server logs | List in the administration area, with an unblock button |
Frequently asked questions
Can I get blocked?
If you get the password wrong many times in a row, yes. It's temporary and the operator can unblock you sooner. That's why a password manager is a good idea.
Why isn't the number of attempts stated?
Because it is useful information for whoever is attacking. The details of the throttling and blocking are not published.