Quote from: iruu on January 24, 2014, 11:43:06 PM

Quote from: EvilDave on January 24, 2014, 11:32:10 PM

Quote from: iruu on January 24, 2014, 10:20:34 PM

It's easy to defeat bruteforce.

Instead of using the password for account, use the password as an input for PBKDF2 with number of iterations inversely related to password's length.
The relation: one second for safe passwords, longer for unsafe, let's say it's 15 second for something like "apple".

This makes bruteforcing much harder even for short passwords.

It's possible to add a second simple field, even an user's real name, and use it as a salt. The combination would make bruteforcing almost impossible.

For compatibility with other accounts, it's enough to add a checkbox 'use older password system'.

I can implement this in JS. Jitted JS in new browsers is fast enough. I asked Jean-Luc if he would include this if I did (no point writing only for myself - I have a secure password) but he wasn't interested.

https://forums.nxtcrypto.org/viewtopic.php?f=17&t=557

Forgive me for not being all that technically brilliant.
My understanding of what this idea translates to is a timeout in between each password log-in attempt, with the timeout period increasing for simpler passwords. Have I got the idea?

It seems like a good idea to me, maybe just set a default time between log-in attempts of 10-30 seconds. That will at least slow directed BF attacks down considerably. However, there is nothing to stop the attacker attacking multiple accounts simultaeneously, switching between targets as it gets locked out.

Someone, whose name I shall not mention, did float the idea of creating a hashcat(?)-based tool to carry out an automated bruteforce attack on the entire NXT blockchain, ie all accounts. Maybe this has been implemented.......we need to keep a very good watch out for hacking reports, and take them seriously.

Yes to the timeout. 1 second in js should mean that gpu crackers take at least few ms per password (taking parallel cracking into account), which is enough to make cracking infeasible for all but simplest dictionary passwords.

This is exactly what I was asking myself - doesn't it take "seconds" to input password then login -> How is it then possible to brutforce with tons of passwords?