On Thu, Mar 24, 2005 at 07:33:40PM -0000, Jason W wrote: > > >Resource metering through client-side computationally intensive "electronic > >payments" can provide an alternative strategy in defending against brute > >force guessing attacks. > > The first question I had was, > Why not just use a turing test. It's simple and, theoretically, only humans can distinguish the passphrase. It requires much less overhead. Obviously this would be used in addition to a password. That's my two cents. True, but this is not foolproof. If you work hard enough, you can get a program to recognize text in an image, even if some lines are crossed in-between. Other 'Turing tests' have similar practical problems, requiring either a human to check the response (which in practice means a human adds a decidedly finite amount of possibilities into the application) or being solvable by a good coder with nothing better to do (which is a pretty accurate description of a hacker, come to think of it... ;-) ) Of course, one might use these two together - the above might cost enough computing power to qualify as 'electronic payment'... Joachim
