Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

This only prevents brute-force password guessing, it doesn't solve the problem of the timing attack. Especially on passwords, which don't change very often. A patient attacker would try only a few attempts at a time, get timing info, then wait out the cooling period until the penalty is back down to 1 second of sleep, then repeat. Each time they gain more information which can all be put together to complete the attack.


With the 1 second sleep (for the first attempt) I was thinking of something along the lines of this:

t1 = time();

/* Perform login credentials check, if okay return */

loginattempt = n;

sleep(n^2 - time() + t1);

In other words, the sleep time includes the time it took to process the login info.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: