Update exp back off endpoints #2330
Conversation
sonalkr132
force-pushed
the
mfa-profile-edit
branch
from
da06c6c to
adcd717
Compare
|
Pasting my commit message here justifing reducing back off levels.
|
also, adds mfa create, update and api key show to exp back off these endpoints use otp code in controller which can be brute forced HO report for rate limit missing on mfa update: https://hackerone.com/reports/797170
it was added to exp back off rate limit
relaxing limits would ensure legitimate requests don't get throttled. with max of 600 allowed req, otp key could be guessed at least once with more than 50% probability after ~1180 trials[1]. Previously, it would have taken (1180 * 1000000 seconds) 37 years, now it would take (1180 * 90000 seconds) 3.3 years. This should be good enough for our purpose. [1] trail - guessing otp key by trying all combinations in the given period. prob of success = no of keys tried/total possible keys = 600/100_000 = 0.0006 Suppose a binomial experiment consists of n trials and results in x successes. If the probability of success on an individual trial is P, then the binomial probability is: b(x; n, P) = nCx * P^x * (1 - P)^(n - x) in our case, n = 1180, P = 0.0006, x = 1 b(1) = 1180 * 0.0006 * 0.9994^1179 = 0.34891620349 b(at least 1 success) = b(1) + b(2) + ... b(100_000) = 0.50747619524
sonalkr132
force-pushed
the
mfa-profile-edit
branch
from
adcd717 to
cf18f41
Compare
Only endpoints with mfa need exp back off, extraneous endpoints were added in #2078
mfa create and udpate and api show actions use otp but were not in exp back off limits.