Re: New Whitepaper: Anti Brute Force Resource Metering
On Thu, Mar 24, 2005 at 07:33:40PM -0000, Jason W wrote:
>
> >Resource metering through client-side computationally intensive "electronic
> >payments" can provide an alternative strategy in defending against brute
> >force guessing attacks.
>
> The first question I had was,
> Why not just use a turing test. It's simple and, theoretically, only humans
> can distinguish the passphrase. It requires much less overhead. Obviously
> this would be used in addition to a password. That's my two cents.
True, but this is not foolproof. If you work hard enough, you can get a
program to recognize text in an image, even if some lines are crossed
in-between. Other 'Turing tests' have similar practical problems,
requiring either a human to check the response (which in practice means
a human adds a decidedly finite amount of possibilities into the
application) or being solvable by a good coder with nothing better to
do (which is a pretty accurate description of a hacker, come to think of
it... ;-) )
Of course, one might use these two together - the above might cost
enough computing power to qualify as 'electronic payment'...
Joachim