Credential stuffing

Guessing needs many attempts against one account, which a per-account lockout stops.

Stuffing needs one attempt against each of many accounts, which a per-account lockout never triggers.

The traffic is also distributed across many addresses, so a per-address limit sees a normal volume from each.

And the credentials are valid, so nothing about an individual attempt looks anomalous until it succeeds.

Which is why login rate limiting is necessary and insufficient: it raises the cost and does not change the outcome.

Multi-factor authentication, which is the single most effective control because a correct password alone stops being enough.

Checking passwords at registration and at change against known-breached lists, which removes the reused pairs before they matter.

Detecting the pattern rather than the volume: many accounts attempted once each, rather than one account attempted many times.

Alerting on a sign-in from a new device or location, which turns a successful stuffing attempt into something the account holder notices.

Passkeys remove the class entirely, because there is no reusable secret to stuff.

Distinguish a wrong password from an unknown account, which lets an attacker enumerate valid usernames before trying anything.

Reveal through timing what it will not reveal through wording, which is the same disclosure by another route.

Sit behind no protection at all on a default path, which is where automated traffic looks first.

None of this is exotic, and all of it is the kind of detail that survives for years because nothing about it fails visibly.

Whether a public login entry point exists, which is what makes any of this relevant.

Whether multi-factor authentication is mentioned publicly — a mention, which cannot establish enforcement.

Whether federated sign-in is offered, which shifts credential handling to a provider that does it full time.

Whether a protection layer sits in front of the site. Nothing is ever submitted to a login form, and no credential is tried.

Breached credential sets circulate in aggregate, combining many incidents into a single very large file.

Age barely reduces their value, because a password reused four years ago is frequently still in use somewhere.

Which is why checking new and changed passwords against known-breached lists is worth more than any complexity rule.

And why a site that has never been breached is still exposed: the credentials come from somewhere else entirely.