ReferenceIncidentsEra 2 · SeedCredential stuffingBots tried leaked passwords: 20× the logins, each one a bcrypt hash.What happens#Bots tried leaked passwords: 20× the logins, each one a bcrypt hash.How to prevent it#A WAF blocks most of them. An Auth Provider hashes the rest.The postmortem opens the first of these that you do not own yet:Web application firewallManaged identityEngineering terms#BcryptCredential stuffing