You have a security problem - your users
summary
Shows actual attack data and defenses: credential stuffing tools run on proxies and botnets, sometimes 900,000 attempts over 30 hours yielding 0.1% valid accounts; another run uses 60,000 IPs from 210 countries across 10 hours. Demonstrates registration/email enumeration, CAPTCHA solving, fake-account probes, and residential vs data‑center proxies. Gives measured outcomes (success rates, costs per account cents to tens of dollars) and concrete mitigations like suppressing existence leaks, blocklists, and monitoring success/fail ratios.
AI-written summary · about
chapters (9)
- 0:00Start
- 0:21stolen credentials and account takeover
- 5:47Passwords are leaked
- 8:59Password spraying
- 9:22Credential stuffing
- 10:52Checking credentials
- 26:18Registration and password reset attacks
- 36:07Do use tools
- 38:20OWASP Guide
related talks
41mThe State Of Credential Stuffing And The Future Of Account Takeovers
29mBecoming You: A Glimpse Into Credential Abuse
49mAre you human or a damn bot?
44mThe Unpatchables: Credential Stuffing Quantification and Classification
41m📙 The Great Credential Caper: How to Perform and then Defend Against the (Nearly Impossible) to Defend 🏗️
31mStrategies for Identifying and Mitigating Bot Threats
26mIntegrating Identity and Fraud
52mKnock Knock: Understanding Who is Using Your Web Applications