Pangolin allows an optional 6-digit PIN for authenticating through SSO. Modern hardware and GPU's can crack 6-digits (100000 values) in mere seconds. From ChatGPT:
Here are some estimated cracking times for a 6-digit numerical PIN using modern hardware:
CPU:
Intel Core i9-11900K: around **10-30 seconds** to crack the PIN (using brute-force algorithms)
AMD Ryzen Threadripper 3970X: around **15-45 seconds** to crack the PIN
GPU:
NVIDIA GeForce RTX 3080 Ti: around **1-3 seconds to crack the PIN** (using GPU-accelerated cryptanalysis tools)
AMD Radeon Instinct MI60: around **2-6 seconds to crack the PIN**
Is it possible to implement rate-limiting within Pangolin to prevent these types of brute-force attacks? It would need to be aggressive, to the point that 2 or more failures results in a significant cooldown to prevent modern hardware from cracking it.
The alternative could be to allow special characters, pair the PIN with a 2FA of some sort, or eliminate the PIN altogether. Curious on what the developer's thoughts are on this, thanks!
Originally created by @kmanwar89 on GitHub (Jun 6, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/857
Pangolin allows an optional 6-digit PIN for authenticating through SSO. Modern hardware and GPU's can crack 6-digits (100000 values) in mere seconds. From ChatGPT:
```
Here are some estimated cracking times for a 6-digit numerical PIN using modern hardware:
CPU:
Intel Core i9-11900K: around **10-30 seconds** to crack the PIN (using brute-force algorithms)
AMD Ryzen Threadripper 3970X: around **15-45 seconds** to crack the PIN
GPU:
NVIDIA GeForce RTX 3080 Ti: around **1-3 seconds to crack the PIN** (using GPU-accelerated cryptanalysis tools)
AMD Radeon Instinct MI60: around **2-6 seconds to crack the PIN**
```
Is it possible to implement rate-limiting within Pangolin to prevent these types of brute-force attacks? It would need to be aggressive, to the point that 2 or more failures results in a significant cooldown to prevent modern hardware from cracking it.
The alternative could be to allow special characters, pair the PIN with a 2FA of some sort, or eliminate the PIN altogether. Curious on what the developer's thoughts are on this, thanks!
<!-- gh-comment-id:2949512344 -->
@oschwartz10612 commented on GitHub (Jun 6, 2025):
Hi! There is already rate limits on the API which I think will cover this you can see in the config.yml file.
```
rate_limits:
global:
window_minutes: 1
max_requests: 100
```
Thanks @oschwartz10612 - what's the "blocking" action if the rate limit is exceeded? Does the limit also apply when interacting through the GUI (which I'm assuming uses the API on the backend?) - thank you for taking the time to comment!
<!-- gh-comment-id:2950733640 -->
@kmanwar89 commented on GitHub (Jun 6, 2025):
Thanks @oschwartz10612 - what's the "blocking" action if the rate limit is exceeded? Does the limit also apply when interacting through the GUI (which I'm assuming uses the API on the backend?) - thank you for taking the time to comment!
@oschwartz10612 commented on GitHub (Jun 8, 2025):
I think you will get a too many requests error from the API and would see an error toast in the front end.
<!-- gh-comment-id:2954058463 -->
@oschwartz10612 commented on GitHub (Jun 8, 2025):
I think you will get a `too many requests` error from the API and would see an error toast in the front end.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @kmanwar89 on GitHub (Jun 6, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/857
Pangolin allows an optional 6-digit PIN for authenticating through SSO. Modern hardware and GPU's can crack 6-digits (100000 values) in mere seconds. From ChatGPT:
Is it possible to implement rate-limiting within Pangolin to prevent these types of brute-force attacks? It would need to be aggressive, to the point that 2 or more failures results in a significant cooldown to prevent modern hardware from cracking it.
The alternative could be to allow special characters, pair the PIN with a 2FA of some sort, or eliminate the PIN altogether. Curious on what the developer's thoughts are on this, thanks!
@oschwartz10612 commented on GitHub (Jun 6, 2025):
Hi! There is already rate limits on the API which I think will cover this you can see in the config.yml file.
@oschwartz10612 commented on GitHub (Jun 6, 2025):
Reopen if I am wrong though please! Thanks for the suggestion!
@kmanwar89 commented on GitHub (Jun 6, 2025):
Thanks @oschwartz10612 - what's the "blocking" action if the rate limit is exceeded? Does the limit also apply when interacting through the GUI (which I'm assuming uses the API on the backend?) - thank you for taking the time to comment!
@oschwartz10612 commented on GitHub (Jun 8, 2025):
I think you will get a
too many requestserror from the API and would see an error toast in the front end.