"I want my money back!" Limiting Online Password-Guessing Financially
نویسندگان
چکیده
Online password guessing attacks are a serious threat to the integrity of online accounts. A common defense is ratelimiting, either by slowing down or blocking connections, or by requiring CAPTCHAs to be solved. Either of these options has serious drawbacks, facilitating denial of service attacks, being circumventable by proxies and CAPTCHA solving services, and offering bad usability to the legitimate user. Furthermore, guessing attacks are becoming increasingly easier, fueled by recent data breaches containing several hundred million credentials from famous websites. In this work-in-progress report, we propose an opt-in depositbased approach to rate-limiting that tackles online guessing attacks. By demanding a small deposit for each login attempt, which is immediately refunded after a successful sign in, online guessing attackers face high costs for repeated unsuccessful logins. We provide an initial analysis of suitable payment systems and reasonable deposit values for realworld implementations and discuss security and usability implications of the system.
منابع مشابه
Off-line Password Guessing Attack on an Efficient Key Agreement Protocol for Secure Authentication
In 2004, Kim, Huh, Hwang and Lee proposed an efficient key agreement protocol for secure authentication. In this paper, we shall show that their proposed protocol cannot resist the off-line password guessing attack and therefore present a modified protocol to avoid this attack.
متن کاملAn Algorithm for Approximate Membership checking with Application to Password Security
Given a large set of words W, we want to be able to determine quickly whether a query word q is close to any word in the set. A new data structure is presented that allows such queries to be answered very quickly even for huge sets if the words are not too long and the query is quite close. The major application is in limiting password guessing by verifying, before a password is approved, that ...
متن کاملCryptanalysis on a Three Party Key Exchange Protocol-STPKE'
In the secure communication areas, three-party authenticated key exchange protocol is an important cryptographic technique. In this protocol, two clients will share a human-memorable password with a trusted server, in which two users can generate a secure session key. On the other hand the protocol should resist all types of password guessing attacks. Recently, STPKE’ protocol has been proposed...
متن کاملFrom the Editor: Security Community--Blurring the Line between Authentication and Identification
I have numerous customer cards. I don't use them to identify myself as a private person but rather to build and maintain a profile. I earn (too many) frequent-flyer miles, I get a (very small) discount when I shop for groceries, and so on. Companies add a financial advantage to the convenience, and I choose to take advantage of it. But if I drop by my local shop to buy contraceptives, I refrain...
متن کاملInvestigating the Relationship Between Password Distribution and Zipf’s Law
In this paper we want to look at the distribution with which passwords are chosen. Zipf’s Law is commonly observed in lists of chosen words. Using password lists from four different on-line sources, we will investigate if Zipf’s law is a good candidate for describing the frequency with which passwords are chosen. We look at a number of standard statistics, used to measure the security of passwo...
متن کامل