ReferenceGlossary
Credential stuffing
An attack where bots try username and password pairs leaked from other sites against a login form. It works because many people reuse passwords. Each try also costs the site a slow password hash.
Security
In Quorum#
The Credential stuffing Incident can start from Seed when your Company serves login. Bots send 19 times your normal login rate, and each one costs an App Server a full bcrypt hash, so CPU saturates. A WAF blocks most of the bots: 80% at the default paranoia level 2. An Auth Provider hashes the rest, so a login costs your App Server about 2 ms of CPU.