Brute.Fail: Watch brute force attacks fail in real time (brute.fail)

Article summary

The article presents a real-time display of brute force attacks attempting to guess usernames and passwords on the author's servers. The attacks are shown with the IP addresses partially redacted. The author notes that no legitimate services are offered on the addresses receiving these attempts, so there is no chance of a real user accidentally submitting their credentials. The display shows various passwords being tried, including some that appear to be from a Chinese word list.

Main themes

• brute force attacks
• SSH security
• password authentication
• public key authentication
• IP address redaction
• XSS attacks
• SSH key management

What commenters say

• Some commenters argue that redacting IP addresses is unnecessary and that exposing them could help identify and stop malicious activity.
• Others counter that redacting IP addresses is a polite and responsible practice, as many brute force attempts come from compromised residential PCs whose owners may not be aware of the issue.
• There is a debate about the security of using password-based login versus public key authentication for SSH, with some arguing that public key authentication is more secure and others arguing that strong passwords can be just as effective.
• Some commenters note that allowing root password login can be a security risk, while others argue that it is not a significant risk if strong passwords are used.
• The use of SSH agent forwarding is discussed, with some arguing that it is a convenient and secure way to manage SSH keys, while others point out potential security risks.
• There is a discussion about the best way to handle SSH keys, with some arguing that they should be stored on a secure enclave like a Yubikey, while others argue that storing them on disk is sufficient if proper precautions are taken.
• Some commenters argue that escaping user input on the server side is sufficient to prevent XSS attacks, while others argue that it is better to escape input at render time to be safe.
• There is a debate about the effectiveness of brute force attacks, with some commenters noting that they are a significant security risk, while others argue that they are relatively rare and can be easily mitigated with proper security measures.