Rate Limiting & Abuse Economics
How limiters actually behave under attack, which keys to count on, how to lock out safely, what attacks cost both sides, and how to keep honest users out of the blast radius.
Requires: OTP Cryptography Internals, Threat Modeling OTP Flows
Chapters
- 1
Fixed window, sliding window, token bucket — behavior under attack
Three classic limiters, one adversary. See where each leaks, how much memory each costs, and which to use at which layer.
6 min read
- 2
Choosing keys: phone, IP, device, account — and collisions
Every limit counts something. Pick keys an attacker cannot cheaply rotate, and stop honest users who share one from tripping each other.
5 min read
- 3
Cooldowns, lockouts and progressive delays done safely
Slow attackers down without handing them a button that locks out your users. Design consequences that scale with evidence.
6 min read
- 4
What an attack costs both sides
Model attacker spend against attacker return, and defender cost against defender loss — with every number labelled as illustrative.
6 min read
- 5
Protecting honest users: false positives and recovery paths
Every abuse control misfires sometimes. Measure the misfires, design graceful exits, and make sure the exit isn’t a new door for attackers.
5 min read