1

How many times would an attacker have to enter the same password when doing a string comparison timing attack? I assume it would have to be at least a few dozen times to average out network lag, for example. If the number is significantly more than the number a normal user would enter, is checking the number of times a person enters a password an effective way to combat string comparison timing attacks? For example, if the tries of the same password exceeds 100 then require a CAPTCHA? Is this more resource efficient than simply checking the whole password?

5

You should already be rate-limiting login attempts after a few requests (temporary lockout, CAPTCHA, Clippy popping up and berating you, etc.). This is a common way to stop brute-force attacks, and it will also seriously cripple those trying to do timing attacks.

Edit:

Also, if you're hashing passwords and looking them up in a database, timing attacks shouldn't be very relevant. The attacker would have to be able to produce arbitrary hashes to gradually "home in" on the right one. This is very difficult!

Timing attacks will be more relevant for things like session cookies

| improve this answer | |
  • So how many times would an attack have to enter the same password to average out network lag? (Question out of curiosity) – APCoding Jul 22 '15 at 14:49
  • I would guess around 100 or so? – APCoding Jul 22 '15 at 14:54
  • This article from 2009 suggests you need thousands of samples (one trial group used 27,000 samples, and others ranged from 13,000 to 68,000 samples). It probably depends on network and hardware quality quite a bit, as well as how accurate you need the results to actually be. – etherealflux Jul 22 '15 at 14:54
  • 2
    Also, if you're hashing passwords and looking them up in a database which is not very likely when using salt (and everyone does that, right?). – Cthulhu Jul 22 '15 at 15:01
  • 1
    Hashing passwords with salt, pepper, olive oil, and garlic, yes :D – etherealflux Jul 22 '15 at 15:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.