bugtraq - Re: New Whitepaper: Anti Brute Force Resource Metering

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20050325220303.GD24863@percy.comedia.it>
Date: Fri, 25 Mar 2005 23:03:03 +0100
From: Luca Berra <bluca@...edia.it>
To: bugtraq@...urityfocus.com
Subject: Re: New Whitepaper: Anti Brute Force Resource Metering


On Thu, Mar 24, 2005 at 07:33:40PM -0000, Jason W wrote:
>In-Reply-To: <20050321182737.81B6B15F507@...l.ngssoftware.com>
>
>
>>Resource metering through client-side computationally intensive "electronic
>>payments" can provide an alternative strategy in defending against brute
>>force guessing attacks.  
>
>
>The first question I had was,
>Why not just use a turing test. It's simple and, theoretically, only humans can distinguish the passphrase. It requires much less overhead. Obviously this would be used in addition to a password. That's my two cents. 

Be certain that your turing test does not rule out certain classes of
humans, eg. a text displayed as an image would be undecipherable by a
blind user.

Regards,
L.

-- 
Luca Berra -- bluca@...edia.it
        Communication Media & Services S.r.l.
 /"\
 \ /     ASCII RIBBON CAMPAIGN
  X        AGAINST HTML MAIL
 / \