Re: New Whitepaper: Anti Brute Force Resource Metering

On Thu, Mar 24, 2005 at 07:33:40PM -0000, Jason W wrote:
> > Resource metering through client-side computationally intensive "electronic
> > payments" can provide an alternative strategy in defending against brute
> > force guessing attacks.  
>
> The first question I had was,
> Why not just use a turing test. It's simple and, theoretically, only humans 
> can distinguish the passphrase. It requires much less overhead. Obviously 
> this would be used in addition to a password. That's my two cents. 

True, but this is not foolproof. If you work hard enough, you can get a
program to recognize text in an image, even if some lines are crossed
in-between. Other 'Turing tests' have similar practical problems,
requiring either a human to check the response (which in practice means
a human adds a decidedly finite amount of possibilities into the
application) or being solvable by a good coder with nothing better to
do (which is a pretty accurate description of a hacker, come to think of
it... ;-) )

Of course, one might use these two together - the above might cost
enough computing power to qualify as 'electronic payment'...

                Joachim