Fortify the Fort: Think outside the security
summary
Octa blocks about 3 billion attacks per month and Google once mitigated a DDoS peaking at 398 million requests per second. A conference app built without login exposes a race condition allowed Gmail access after a script fires thousands of requests per minute, so the backend stores device IDs and sets a flag to zero returning 429s to throttle offenders. Use device biometrics plus secure credential storage (KeyStore/secure credential manager) to protect refresh tokens that can live up to 90 days, and enforce burst, concurrent and client/end‑user rate limits.
AI-written summary · about
chapters (9)
- 0:00Security threats introduction
- 3:18PKCE authorization flow
- 5:05Past project security gap
- 8:59Rate limiting defense
- 12:53Safer auth UI rendering
- 14:43Biometric refresh tokens
- 17:32Biometric exceptions handling
- 19:01Rate limiting best practices
- 20:25Closing remarks
related talks
33mHow to implement DDoS protection in GCP
01h 00mIoT Lockdown - Battling Bot Net Builders
40mThe new reality of DDOS
42mWarding against the Dark Arts: Crafting a Defense Strategy against Botnet DDoS
29mGraphQL Security Best Practices and Hardening
30mYour App is a Giant DDOS Botnet
52mNot all attacks are malicious: DDoS from outside and within
52mKnock Knock: Understanding Who is Using Your Web Applications