How GitLab is fighting credential stuffing and platform abuse
Aug 19, 2022Monmayuri Ray
Summary
This post details the implementation of Arkose Protect into the user login flow to combat credential stuffing attacks. It describes the risk assessment process using IP address, user activity, and failed login attempts, and the use of an enhanced CAPTCHA for higher-risk sessions. The post also mentions future plans for a holistic user scoring engine.
More from the Security Control Framework trail
- Track organization-wide security risk in one dashboard
- Dependency Firewall: Block risky packages before the build
- Two front doors: Module-level access in a Django GRC app
- How GitLab tracks vulnerabilities through refactors and reformatting
- Shai-Hulud copycat campaign targets Python developers through PyPI typosquatting