Bugtraq: Re: New Whitepaper: Anti Brute Force Resource Metering

[Luca Berra <bluca () comedia it>]

On Thu, Mar 24, 2005 at 07:33:40PM -0000, Jason W wrote:
> In-Reply-To: <20050321182737.81B6B15F507 () mail ngssoftware com>
>
>
> > Resource metering through client-side computationally intensive "electronic
> > payments" can provide an alternative strategy in defending against brute
> > force guessing attacks.  
>
> The first question I had was,
> Why not just use a turing test. It's simple and, theoretically, only humans can distinguish the passphrase. It requires much less overhead. Obviously this would be used in addition to a password. That's my two cents. 
Be certain that your turing test does not rule out certain classes of
humans, eg. a text displayed as an image would be undecipherable by a
blind user.

Regards,
L.

--
Luca Berra -- bluca () comedia it
       Communication Media & Services S.r.l.
/"\
\ /     ASCII RIBBON CAMPAIGN
 X        AGAINST HTML MAIL
/ \