Bugtraq mailing list archives
Re: New Whitepaper: Anti Brute Force Resource Metering
From: Joachim Schipper <j.schipper () math uu nl>
Date: Fri, 25 Mar 2005 00:07:25 +0100
On Thu, Mar 24, 2005 at 07:33:40PM -0000, Jason W wrote:
Resource metering through client-side computationally intensive "electronic payments" can provide an alternative strategy in defending against brute force guessing attacks.The first question I had was, Why not just use a turing test. It's simple and, theoretically, only humans can distinguish the passphrase. It requires much less overhead. Obviously this would be used in addition to a password. That's my two cents.
True, but this is not foolproof. If you work hard enough, you can get a program to recognize text in an image, even if some lines are crossed in-between. Other 'Turing tests' have similar practical problems, requiring either a human to check the response (which in practice means a human adds a decidedly finite amount of possibilities into the application) or being solvable by a good coder with nothing better to do (which is a pretty accurate description of a hacker, come to think of it... ;-) ) Of course, one might use these two together - the above might cost enough computing power to qualify as 'electronic payment'... Joachim
Current thread:
- New Whitepaper: Anti Brute Force Resource Metering Gunter Ollmann (NGS) (Mar 21)
- Re: New Whitepaper: Anti Brute Force Resource Metering Amit Klein (AKsecurity) (Mar 22)
- Re: New Whitepaper: Anti Brute Force Resource Metering Gunter Ollmann (Mar 23)
- Re: New Whitepaper: Anti Brute Force Resource Metering Amit Klein (AKsecurity) (Mar 25)
- Re: New Whitepaper: Anti Brute Force Resource Metering Gunter Ollmann (Mar 23)
- Re: New Whitepaper: Anti Brute Force Resource Metering Peter J. Holzer (Mar 23)
- <Possible follow-ups>
- Re: New Whitepaper: Anti Brute Force Resource Metering Jason W (Mar 24)
- Re: New Whitepaper: Anti Brute Force Resource Metering Joachim Schipper (Mar 25)
- Re: New Whitepaper: Anti Brute Force Resource Metering Luca Berra (Mar 26)
- Re: New Whitepaper: Anti Brute Force Resource Metering Amit Klein (AKsecurity) (Mar 22)