News for hackers. Stuff that matters.

A comment on Google disables compression for OpenSSL in Chrome - SSL exploit coming?. Parent comment

Re:Google disables compression for OpenSSL in Chrome - SSL e... by jlgreco on Wednesday September 12, 2012 @12:38PM (#4511506)
That "Guess the password one char at a time" thing also occurs in real life when people forget to use constant time comparison functions.
[ Parent | on HN ]
Re:Google disables compression for OpenSSL in Chrome - SSL e... by bloaf on Wednesday September 12, 2012 @01:25PM (#4511772)
A better comparison function:

Variable time until some threshold number of repeat failures occurs (e.g. 3). After this, manipulate the comparison time in such a manner that someone attempting to do this sort of attack would come up with a dummy password. If they come up with said dummy password, alert the user of an attempted attack.

[ Parent | on HN ]
Re:Google disables compression for OpenSSL in Chrome - SSL e... by krickle on Wednesday September 12, 2012 @02:33PM (#4512218)
Cool idea, but remember the botnets. I also am not sure what we gain by verifying their class of attempt if we're already defending against it.
[ Parent | on HN ]