Attackers try leaked email/password pairs from other breaches against your login. Strongest mitigation?
Options
- Longer session timeouts for every logged-in user
- MFA, plus rate limiting and breached-password checks (Correct option)
- Hiding the URL of the login page from the public
- Switching the login form to use GET requests
Answer
Multi-factor authentication, plus rate limiting and breached-password checks
Why
People reuse passwords. When another site is breached, attackers try those email/password pairs on many other sites automatically: credential stuffing.
MFA stops most of it, because the password alone is not enough.
Also rate-limit login attempts per IP and per account, detect bots, and reject passwords known to be in breaches.
Remember
Credential stuffing → MFA + rate limiting.