Dictionary Attacks 101
codinghorror.com
Dictionary Attacks 101
1–10 of 14 posts
Re: Dictionary Attacks 101
#2As described I don't really see how the solution proposed handles DoS attacks any better than a lock out after x failed attempts.
The key to preventing DoS attacks is that the throttling is specific to a given host so that when the genuine user attempts to log on (presumably from a different host than the attacker) they can do so without any throttling.
Re: Dictionary Attacks 101
#3As described I don't really see how the solution proposed handles DoS attacks any better than a lock out after x failed attempts. The key to preventing DoS attacks is that the throttling is specific to a given host so that when the genuine user attempts to log on (presumably from a different host than the attacker) they can do so without any throttling.
DoS meaning you can lock people out of their accounts, not that the site is brought down.
Re: Dictionary Attacks 101
#4As described I don't really see how the solution proposed handles DoS attacks any better than a lock out after x failed attempts. The key to preventing DoS attacks is that the throttling is specific to a given host so that when the genuine user attempts to log on (presumably from a different host than the attacker) they can do so without any throttling.
Which fails against any attacker with a botnet, so, solve the lockout problem first, and deal with DoS (which you can't ever really solve) later.
Re: Dictionary Attacks 101
#5I've found 1Password (http://agilewebsolutions.com/products/1Password) to be a great solution to this. It automatically generates passwords for you and saves logins on an encrypted file. The only problem I've found with it is that when you go to use a friend's computer or a public computer you don't always know your passwords. A web service version of it would be convenient, but the security implications are obvious..
Re: Dictionary Attacks 101
#6I've found 1Password ( http://agilewebsolutions.com/products/1Password ) to be a great solution to this. It automatically generates passwords for you and saves logins on an encrypted file. The only problem I've found with it is that when you go to use a friend's computer or a public computer you don't always know your passwords. A web service version of it would be convenient, but the security implications are obviou…
something like http://www.angel.net/~nic/passwd.html (placed on your own server, behind ssl, of course)
Re: Dictionary Attacks 101
#7How do you implement a failed login delay?
I assume you'd have to just sleep before sending the response. But this could tie up all available threads for processing requests and bring down the site under heavy attack.
Re: Dictionary Attacks 101
#8How do you implement a failed login delay? I assume you'd have to just sleep before sending the response. But this could tie up all available threads for processing requests and bring down the site under heavy attack.
You refuse to allow login during the delay period. That is, after the 5th failed login, for the next 16 seconds, if the user tries to login, you say "Wait sometime before trying again." You do not accept and check the credentials supplied during this time. You simply refuse to begin the authentication process until the delay period has elapsed.
Re: Dictionary Attacks 101
#9I've found 1Password ( http://agilewebsolutions.com/products/1Password ) to be a great solution to this. It automatically generates passwords for you and saves logins on an encrypted file. The only problem I've found with it is that when you go to use a friend's computer or a public computer you don't always know your passwords. A web service version of it would be convenient, but the security implications are obviou…
For the sake of a working solution I also just store passwords in encrypted files (using encfs, though) and stop worrying about accessing everything from my non-main computers.
Script for new passwords follows, for the fun of it. I have stuff added afterwards to save the username, website, and password to encrypted files.
#!/usr/bin/env python
import string
from random import Random
okchars = string.letters + string.digits + "!@%^_&*+-"
print ''.join( Random().sample(okchars, 40) )Re: Dictionary Attacks 101
#10As described I don't really see how the solution proposed handles DoS attacks any better than a lock out after x failed attempts. The key to preventing DoS attacks is that the throttling is specific to a given host so that when the genuine user attempts to log on (presumably from a different host than the attacker) they can do so without any throttling.
DoS is a different problem. That's about trying to soak up the entire bandwidth of your servers using lots of computers.
If you are throttling number of login attempts per account then it doesn't matter what the IP address being used is.