4 ms·
This only prevents brute-force password guessing, it doesn't solve the problem of the timing attack. Especially on passwords, which don't change very often. A p
by jeffreyg 15y ago
This only prevents brute-force password guessing, it doesn't solve the problem of the timing attack. Especially on passwords, which don't change very often. A patient attacker would try only a few attempts at a time, get timing info, then wait out the cooling period until the penalty is back down to 1 second of sleep, then repeat. Each time they gain more information which can all be put together to complete the attack.
- Rinum 15y agoWith the 1 second sleep (for the first attempt) I was thinking of something along the lines of this: t1 = time(); /* Perform login credentials check, if okay return */ loginattempt = n; sleep(n^2 - time() + t1); In other words, the sleep time includes the time it took to process the login info.