Skip to content
DevMeme
5379 of 7590
A Developer's Diabolical 'Brute-Force Protection' Logic
Security Post #5898 · source on Telegram

A Developer's Diabolical 'Brute-Force Protection' Logic

Description

A three-panel comic strip depicting an office scene. In the first panel, a group of colleagues looks on in horror at a developer's computer screen, with one asking, 'Hey! What's going on?'. The developer at the computer has a smug look. In the second panel, the horror intensifies: one man spits out his coffee, others are in shock, and a woman exclaims, 'Sick bastard!'. The developer gives a calm thumbs-up. The third panel reveals the cause of their reaction: a close-up of a monitor displaying a code snippet. The code, under a comment '// brute-force attack protection', reads: 'if isPasswordCorrect && isFirstLoginAttempt { Error("Wrong login or password") }'. The humor comes from the deliberately perverse and chaotic logic. Instead of protecting against attacks, this code ensures that a user with the correct password will be locked out specifically on their first attempt, causing maximum confusion and frustration, while likely failing to prevent any actual security threats

Categories

Security CodeQuality Bugs Debugging Troubleshooting DeveloperExperience DX

Common Tags

BruteForce Authentication SecurityFlaws SecurityVsUsability SubtleBugs CodeQuality EngineeringAbsurdity

Comments

32
Anonymous ★ Top Pick This isn't a security feature; it's a CAPTCHA for emotions. It just checks if the user is human enough to feel infuriated
  1. Anonymous ★ Top Pick

    This isn't a security feature; it's a CAPTCHA for emotions. It just checks if the user is human enough to feel infuriated

  2. Anonymous

    Why bother rate-limiting when you can ship Schrödinger’s password - simultaneously valid and invalid until attempt two?

  3. Anonymous

    This is the authentication equivalent of a bouncer who only lets you into the club if you give the wrong password - but just on your first try. After 20 years in this industry, I've seen this exact pattern deployed to production at least three times, usually right before a major product launch when the CEO decides to 'test the login flow personally'

  4. Anonymous

    When your brute-force protection is so sophisticated it tells attackers 'You got the password right, but I'm going to pretend you didn't because it's your first try.' It's like having a bouncer who says 'Nice try with that correct password, buddy, but company policy says I have to reject you once before letting you in.' This is the authentication equivalent of implementing rate limiting that only triggers after you've already given away whether the credentials are valid - a masterclass in defeating your own security measures through helpful error messages

  5. Anonymous

    If your threat model is 'users who know their password,' this control is airtight

  6. Anonymous

    Marketed as “brute-force protection,” it’s really a human-only rate limit - bots just wrap curl in while(true) and your helpdesk explodes

  7. Anonymous

    Rate-limits successes to gaslight legit users while brute-forcers feast on silent failures - peak architectural irony

  8. @Sp1cyP3pp3r 2y

    THAT'S DEPRAVITY

  9. Deleted Account 2y

    but also very smart

  10. @AmindaEU 2y

    I sometimes wonder if reddit has that

  11. @anatoli26 2y

    actually that makes sense.. though the checks should be swapped

    1. @Saeid025 2y

      Exactly, one less check

  12. @mpolovnev 2y

    USB-A authors have managed to do the same in hardware!

    1. @sylfn 2y

      https://t.me/mmmeme_channel/6677

      1. @sylfn 2y

        thats fucking gold

      2. @ZgGPuo8dZef58K6hxxGVj3Z2 2y

        Skill issue /s

      3. @FunnyGuyU 2y

        You actually CAN insert a USB jack into an Ethernet port. Anyway, there are no wrong ports, there are weak people.

        1. @sylfn 2y

          and thats how I broke PS/2 kb port (by flipping the plug accidentally)

  13. @sfrancisxo 2y

    Художественный фильм "Спиздили"

    1. @ZgGPuo8dZef58K6hxxGVj3Z2 2y

      English

  14. @callofvoid0 2y

    exactly our uni website

  15. @ZgGPuo8dZef58K6hxxGVj3Z2 2y

    Whats limit?

    1. @RiedleroD 2y

      2. but the bot only counts the warns, so in the end, the moderator decides if the person gets another chance

      1. @ZgGPuo8dZef58K6hxxGVj3Z2 2y

        Ah okay

  16. @LionElJonson 2y

    the code is poorly written btw

    1. @callofvoid0 2y

      did you expect the prod code to be posted online?

      1. @LionElJonson 2y

        no, I expect meme code to be written pretty

  17. @ercolebellucci 2y

    How to explain this in music terms

  18. @sylfn 2y

    done

  19. @danylo1554 2y

    Well... Why it won't work?

  20. @Saeid025 2y

    It's actually brilliant

  21. @ageek 2y

    😂😂

More like this

More like this in Security →
Security BruteForce Authentication
Bug Bounties Then Paid XSS; Now AI Says Duplicate

Bug Bounties Then Paid XSS; Now AI Says Duplicate

Security
Frontier-Lab Agent Intrusion, Five Days Unseen

Frontier-Lab Agent Intrusion, Five Days Unseen

Security
Silly Cat Name: SSH Public and Private Keys

Silly Cat Name: SSH Public and Private Keys

Security
Use J and K for navigation