DDoS and bots
Not every player is a person
Bots make fake accounts, farm coins and try passwords. Course 1 covered floods of traffic, called DDoS attacks. This lesson is about bots that act like players.
Credential stuffing
OWASP defines credential stuffing as "Testing username/password pairs obtained from the breach of another site." It works because people reuse passwords.
Multi-factor authentication is "by far the best defense against the majority of password-related attacks".
Quick check
Priya sees thousands of sign-in attempts, each with a different email and password from another site's leak. What is it?
- Credential stuffing
- A DDoS attack
- A bug bounty
Show the answer
Credential stuffing
Leaked username and password pairs, tried on a different site: that is credential stuffing.
Defences in layers
OWASP is honest about each defence:
- CAPTCHAsThey "may slow down" attacks, but "are not perfect".
- Blocking addressesProxy networks "may defeat both IP block-lists and rate limiting".
- FingerprintingRecognises devices, but "can potentially be spoofed".
- Leaked passwordsCheck new passwords against known breaches.
Pick the best defence
Which defence does OWASP rate highest against credential stuffing?
- A second factor, such as a passkey or code
- Blocking one IP address
- A longer CAPTCHA
Show the answer
A second factor, such as a passkey or code
A stolen password alone is no longer enough. The others slow attackers down, but can be got around.
A check with no puzzle
Cloudflare's Turnstile is a "smart CAPTCHA alternative". It runs "a series of small non-interactive JavaScript challenges" so it can usually "avoid showing a visual or interactive puzzle to a user."
For young players, that means no puzzles to fail.
Floods at studio size
Priya puts Shard Garden behind Cloudflare's network, which absorbs floods of traffic before they reach the servers. Rate limits protect each endpoint, so one busy bot can't starve the others.
Quick check
A CAPTCHA on sign-in stops credential stuffing completely.
- True
- False
Show the answer
False
OWASP says CAPTCHAs "are not perfect". They are one layer; a second factor is the strongest.
Friendly attackers
Some people break in to help: they find a flaw and tell the studio.
Bolt says: Next: bug bounties and pen tests.
Fact-checked 12 October 2026
- OWASP: Credential Stuffing Prevention Cheat Sheet cheatsheetseries.owasp.org
- Cloudflare Docs: Turnstile developers.cloudflare.com