SecurityFocus

Re: New Whitepaper: Anti Brute Force Resource Metering Mar 24 2005 07:33PM
Jason W (bugtraq oremhighalumni com) (2 replies)

Re: New Whitepaper: Anti Brute Force Resource Metering Mar 25 2005 10:03PM
Luca Berra (bluca comedia it)

On Thu, Mar 24, 2005 at 07:33:40PM -0000, Jason W wrote:
>In-Reply-To: <20050321182737.81B6B15F507 (at) mail.ngssoftware (dot) com [email concealed]>
>
>
>>Resource metering through client-side computationally intensive "electronic
>>payments" can provide an alternative strategy in defending against brute
>>force guessing attacks.
>
>
>The first question I had was,
>Why not just use a turing test. It's simple and, theoretically, only humans can distinguish the passphrase. It requires much less overhead. Obviously this would be used in addition to a password. That's my two cents.

Be certain that your turing test does not rule out certain classes of
humans, eg. a text displayed as an image would be undecipherable by a
blind user.

Regards,
L.

--
Luca Berra -- bluca (at) comedia (dot) it [email concealed]
Communication Media & Services S.r.l.
/" \ / ASCII RIBBON CAMPAIGN
X AGAINST HTML MAIL
/

[ reply ]

Re: New Whitepaper: Anti Brute Force Resource Metering Mar 24 2005 11:07PM
Joachim Schipper (j schipper math uu nl)