Bugtraq mailing list archives
Re: New Whitepaper: Anti Brute Force Resource Metering
From: Luca Berra <bluca () comedia it>
Date: Fri, 25 Mar 2005 23:03:03 +0100
On Thu, Mar 24, 2005 at 07:33:40PM -0000, Jason W wrote:
In-Reply-To: <20050321182737.81B6B15F507 () mail ngssoftware com>Resource metering through client-side computationally intensive "electronic payments" can provide an alternative strategy in defending against bruteforce guessing attacks.The first question I had was,Why not just use a turing test. It's simple and, theoretically, only humans can distinguish the passphrase. It requires much less overhead. Obviously this would be used in addition to a password. That's my two cents.
Be certain that your turing test does not rule out certain classes of humans, eg. a text displayed as an image would be undecipherable by a blind user. Regards, L. -- Luca Berra -- bluca () comedia it Communication Media & Services S.r.l. /"\ \ / ASCII RIBBON CAMPAIGN X AGAINST HTML MAIL / \
Current thread:
- New Whitepaper: Anti Brute Force Resource Metering Gunter Ollmann (NGS) (Mar 21)
- Re: New Whitepaper: Anti Brute Force Resource Metering Amit Klein (AKsecurity) (Mar 22)
- Re: New Whitepaper: Anti Brute Force Resource Metering Gunter Ollmann (Mar 23)
- Re: New Whitepaper: Anti Brute Force Resource Metering Amit Klein (AKsecurity) (Mar 25)
- Re: New Whitepaper: Anti Brute Force Resource Metering Gunter Ollmann (Mar 23)
- Re: New Whitepaper: Anti Brute Force Resource Metering Peter J. Holzer (Mar 23)
- <Possible follow-ups>
- Re: New Whitepaper: Anti Brute Force Resource Metering Jason W (Mar 24)
- Re: New Whitepaper: Anti Brute Force Resource Metering Joachim Schipper (Mar 25)
- Re: New Whitepaper: Anti Brute Force Resource Metering Luca Berra (Mar 26)
- Re: New Whitepaper: Anti Brute Force Resource Metering Amit Klein (AKsecurity) (Mar 22)