bugtraq - Re: New Whitepaper: Anti Brute Force Resource Metering

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 25 Mar 2005 00:07:25 +0100
From: Joachim Schipper <j.schipper@...h.uu.nl>
To: bugtraq@...urityfocus.com
Subject: Re: New Whitepaper: Anti Brute Force Resource Metering

On Thu, Mar 24, 2005 at 07:33:40PM -0000, Jason W wrote:
> 
> >Resource metering through client-side computationally intensive "electronic
> >payments" can provide an alternative strategy in defending against brute
> >force guessing attacks.  
> 
> The first question I had was,
> Why not just use a turing test. It's simple and, theoretically, only humans can distinguish the passphrase. It requires much less overhead. Obviously this would be used in addition to a password. That's my two cents. 

True, but this is not foolproof. If you work hard enough, you can get a
program to recognize text in an image, even if some lines are crossed
in-between. Other 'Turing tests' have similar practical problems,
requiring either a human to check the response (which in practice means
a human adds a decidedly finite amount of possibilities into the
application) or being solvable by a good coder with nothing better to
do (which is a pretty accurate description of a hacker, come to think of
it... ;-) )

Of course, one might use these two together - the above might cost
enough computing power to qualify as 'electronic payment'...

		Joachim