When bots flood a login endpoint with 50,000 failed attempts across 30,000 IP addresses, legitimate users suddenly face ten-second delays. The bottleneck isn't the network—it’s bcrypt. Bcrypt is deliberately designed to be computationally slow and CPU-intensive to protect stored passwords from brute-force attacks. Because attackers distribute stolen credentials across tens of thousands of IPs and stop just short of account lockout limits, traditional IP rate limiting fails completely while your CPU cores max out hashing garbage passwords.
The solution is to filter malicious traffic before burning precious CPU cycles on password hashing. During the initial connection handshake, the server examines the client's TLS fingerprint to spot telltale differences between an automated script and a legitimate mobile app. By combining handshake signatures with device trust tokens, the architecture can route traffic through a tiered defense: trusted devices get verified immediately, borderline requests face a CAPTCHA challenge, and obvious bots are rejected instantly without running bcrypt at all.
#SystemDesign #CyberSecurity #SoftwareEngineering #TechInterview #WebDevelopment #DevOps