Re: [Quixote-users] Timing attacks against session cookies
Binger David <dbinger-fVcApmY9cLvQ3/1i3zOLAti2O/[email protected]> Mon, 26 Jul 2010 11:02:11 -0400
| Newsgroups | gmane.comp.python.qp,gmane.comp.web.quixote.user |
|---|---|
| Message-ID | <[email protected]> |
On Jul 26, 2010, at 10:28 AM, Neil Schemenauer wrote: > On Mon, Jul 26, 2010 at 10:08:18AM -0400, Binger David wrote: >> What if hash lookup failures do no return until they have completed >> a randomized time-obscuring operation? > > That makes the attack more difficult (more attempts needed) but > doesn't prevent it. Okay, what if the algorithm ensures that some fixed amount of time passes for hash lookup failures? record time try lookup if fail, sleep until time + 1s