Stop credential stuffing

Blunt list-testing against your sign-in. Attackers replay stolen username/password pairs at scale; a CAPTCHA on sign-in plus two Lidar monitors makes the attempt expensive, surfaces it as a Signal, and keeps a real user's failed sign-in from looking like an attack.

What you use

• Bot protection with reCAPTCHA v3 on signin (v3, because signin can render a checkbox but a silent score is less disruptive for real users).
• The Lidar brute_force monitor (detection:brute_force attempts:>100 window:5m), correlated by IP.
• The Lidar credential_stuffing monitor (detection:credential_stuffing attempts:>200 window:15m), correlated across the environment.

Setup

1. Add a reCAPTCHA v3 site in the console under Authentication > Add-ons, and select the signin action.
2. Set the minimum score to 0.5 initially; reject tokens scoring below it and require the echoed action to match signin so a token minted on another page cannot be replayed.
3. Under Lidar > Monitors, enable brute_force and credential_stuffing. Tune attempts: and window: to your traffic shape; a busy environment needs higher floors than the defaults or every legitimate sign-in wave looks like an attack.

Verify

• Replay a small list of bad credentials from one IP in dev: v3 drops the low-score attempts, brute_force fires on the IP, and credential_stuffing fires across the environment once the floor is crossed.
• Confirm a real user with a wrong password does not raise a Signal; the monitors key on volume, not single failures.
• Triage the resulting Signals in Lidar > Signals; the dedup keys keep re-analysis from creating duplicate alerts.

Related

• Prevent signup and free-trial abuse: the same front-door control aimed at sign-up.
• MFA: the second factor that contains a stolen password.
• Lidar concepts: monitor query syntax and correlation keys.
• Bot protection: v3 score handling and fail-closed behavior.