RE: Account Lockouts

> From: The Amazing Dragon [mailto:[email protected]] 
> Sent: Monday, 06 December, 2004 01:22

> Using SIRDS as a transformation might be pretty effective against current
> recognizers.

I've never had any luck at seeing SIRDS pseudo-images, and I know other
people who've had similar difficulty.  I suspect that SIRDS would exclude
too many users.

> Might be
> interesting to use patterns similar to color-blindness tests, but then
> you need to be able to count on someone to be color-sensitive (though you
> can then use this as secondary protection, color-blind get a different
> answer).

Thanks.  I'm colorblind (weak green response), too.  (On the other hand, I
rarely forget my passwords...)

And the different mechanism for colorblind users will either be easier to
recognize than the color-discrimination one, in which case the attacker can
target it, or harder, in which case why not use it for everyone?

> This still only works as long as someone doesn't produce an OCR that
> recognizes them. Only a matter of time.

Indeed.  And it offers no additional strength against human-assisted
attacks, which are probably easier to mount anyway.

CAPTCHAs (what a godawful name) are inherently flawed.  They were created to
distinguish between human users and programs.  That distinction turns out to
be of relatively little value for security in most of the contexts where
CAPTCHAs are being deployed.  CAPTCHAs try to address the wrong problem.

-- 
Michael Wojcik
Principal Software Systems Developer, Micro Focus