The Credential Stuffing Wave That Bypassed IP Rate Limits
The Credential Stuffing Wave That Bypassed IP Rate Limits
Your e-commerce platform's authentication endpoint (/api/v1/login) handles normal login traffic of 400 requests/second. The gateway enforces an IP-based rate limiter of 10 requests per minute per IP address. Over a single weekend, an attacker uses a stolen dump of 50 million username-password pairs from a third-party breach to launch a massive credential stuffing attack. To evade the IP rate limiter, the attacker routes traffic through a commercial residential proxy network (BrightData/Oxylabs), spreading 80,000 login attempts per minute across 600,000 distinct IP addresses. Because each IP sends only one login attempt every 7 minutes, not a single IP rate limiter trips. However, the surge in bcrypt/Argon2 password hash verifications drives authentication server CPU utilization to 100%, quadrupling login latency for legitimate users, while successfully compromising 12,000 customer accounts. You are tasked with architecting a multi-layered bot defense and Sybil-resistant authentication pipeline that blocks distributed credential stuffing without penalizing legitimate user conversion.
The Credential Stuffing Wave That Bypassed IP Rate Limits
Your e-commerce platform's authentication endpoint (/api/v1/login) handles normal login traffic of 400 requests/second. The gateway enforces an IP-based rate limiter of 10 requests per minute per IP address. Over a single weekend, an attacker uses a stolen dump of 50 million username-password pairs from a third-party breach to launch a massive credential stuffing attack. To evade the IP rate limiter, the attacker routes traffic through a commercial residential proxy network (BrightData/Oxylabs), spreading 80,000 login attempts per minute across 600,000 distinct IP addresses. Because each IP sends only one login attempt every 7 minutes, not a single IP rate limiter trips. However, the surge in bcrypt/Argon2 password hash verifications drives authentication server CPU utilization to 100%, quadrupling login latency for legitimate users, while successfully compromising 12,000 customer accounts. You are tasked with architecting a multi-layered bot defense and Sybil-resistant authentication pipeline that blocks distributed credential stuffing without penalizing legitimate user conversion.
Provide 1–2 precise sentences for each architectural dimension. Each box guides you on what staff-level interviewers evaluate.
Define SLA targets, hard consistency constraints, and conditions the system must never violate.
Quantify throughput (QPS/RPS), read:write ratios, and peak burst multipliers.
Step-by-step path: client ingress → API gateway → queues → background workers → persistence.
Database engine, table schema, partition keys (PK/SK), and durability strategy.
What resource hits saturation first under 10x traffic? (CPU, disk IOPS, connection pools, network).
Worker crashes, network partitions, split-brain, poison pill DLQ, retries, and idempotency.
What did you sacrifice in exchange and why? (e.g. eventual consistency vs latency, cost vs redundancy).