Use Bitcoins During Login to Make Brute Force Attack Expensive to the Hacker.

[spreaders]

I had an idea for the use of bitcoins during the login process that would make life more difficult for hackers that use a brute force attack to access an online account. Here are my initial thoughts on how it could be implemented.

User signs up for an account in the usual way, eg user name, password etc, but is also asked for a bitcoin address.

When the user comes to log in to their account the user gives name and password as usual. They are then asked to deposit X bitcoins to an address of the website provider.

User name and password are then verified, along with verification that the requested deposit has been made.

If user name or password are invalid or the deposit has not been made, the user is denyed access.

If the user name is valid the deposited bitcoins are returned to the registered users registered bitcoin address. If not, the bitcoins stay with the website owner.

What a valid user would see is that they pay out X bitcoins but immediately get them returned. If someone is trying to get into their account, they would see a nice little bitcoin bonus being paid to them everytime the hacker tries a new password.

This method would cost a hacker everytime they attempted to break in, thereby detering brute force attacks on websites, with no prospect of ever getting the bitcoins back.

Depending on the sensitivity of the account being protected, could determine the size of the bitcoin deposit to be made each time.

I realise there may be problems with this method, the main one I can think of is the time delay between sending the bitcoins for login and getting a confirmation that allows access.

Anyone wanting to develop a service around this idea, feel free, I'm putting this idea out there to help encourage the use of bitcoins.

[1713575851]

1713575851

[1713575851]

1713575851

[1713575851]

1713575851

[1713575851]

1713575851

[TiagoTiago]

You mean for this forum? That would be an issue for newbies and people coming here to get help to get their clients working etc...

[jostmey]

That time delay is an idea killer.

[wumpus]

Any client-side puzzle will do to slow down brute-force attacks, bitcoin has no specific advantage here IMO

[spreaders]

a puzzle would certainly slow an attack, such as capcha and the like, but this adds a cost to the hacker. Time delay is certainly a killer, but maybe some bright spark will be able to speed things up.

[naturallaw]

I really don't think brute force attacks are a problem these days if people simply choose a decently complex password and the authenticator employs a basic method of blocking continuous password guesses like automatic account locks after a number of invalid logins. There are so many other more viable ways to hijack user accounts these days such as session hijacking, CSRF, XSS, SQL injection, etc.

[TimoWillemsen]

Im sorry but I dont see how sql-injection and xss are still a problem here. Every webdeveloper should know about them. I wouldn't trust a single bitcoin at a website that EVER had such a vulnerability, beacause it means security isn't considered by design.

Finding a method that stops brute forceing without bad user experience can be hard. Im not sqying what the TS suggests is a good idea though.

[Coinbuck @ BTCLot]

Im sorry but I dont see how sql-injection and xss are still a problem here. Every webdeveloper should know about them. I wouldn't trust a single bitcoin at a website that EVER had such a vulnerability, beacause it means security isn't considered by design.

Finding a method that stops brute forceing without bad user experience can be hard. Im not sqying what the TS suggests is a good idea though.

x2

[naturallaw]

I agree, but when was the last time someone hijacked a web account by brute force when the user had a respectable password?

[naturallaw]

It's an interesting idea anyway, spreaders. Might be for more applicable for something else I think though.

[Rob P.]

Two words:  Transaction Fees

[TheRandomGuy]

Two Words: BAD IDEA! 

[dazedtrader]

TradeHill seem to use a captcha to prevent logins being bruce forced. It seems a bit of an odd approach to me ... wouldn't rate throttling on the server be a better solution that wouldn't inconvenience the users every time they log in?

[naturallaw]

TradeHill seem to use a captcha to prevent logins being bruce forced. It seems a bit of an odd approach to me ... wouldn't rate throttling on the server be a better solution that wouldn't inconvenience the users every time they log in?

+5

Maybe they have that too? The API doesn't require a CAPTCHA...

[coga]

Here's another variant of the same idea: Upon login, you see something like this:

Code:

User ID:  [ johndoe               ]
Password: [ --------------------  ]
You have BTC 0.0094. To add, send more BTC to 1x7uDNn2aDugntBy96zBWXE7zt546M6JgY

On every logon, successful or not, web site will send BTC 0.0001 to the user. When balance runs out, user can no longer logon, with or without valid password. The only way to try again is to send BTC to that address. Basically, if you are a hacker, you will need to keep sending BTC in order to try, and the user will keep the dough

Probably not a great idea for password protection per se, but I wonder if there could be more applications to such model

[Rob P.]

Here's another variant of the same idea: Upon login, you see something like this:

Code:

User ID:  [ johndoe               ]
Password: [ --------------------  ]
You have BTC 0.0094. To add, send more BTC to 1x7uDNn2aDugntBy96zBWXE7zt546M6JgY

On every logon, successful or not, web site will send BTC 0.0001 to the user. When balance runs out, user can no longer logon, with or without valid password. The only way to try again is to send BTC to that address. Basically, if you are a hacker, you will need to keep sending BTC in order to try, and the user will keep the dough

Probably not a great idea for password protection per se, but I wonder if there could be more applications to such model

Why would anyone pay money to login?  I understand you're sending to an address and then getting the coins back.  However, there are transaction fees on every send, so you're paying TWICE the transaction fee for every login.

Sure, you could set the transaction fee to 0.  But that's going to seriously delay your ability to login as you wait for the transaction to be added to the block chain.

It's just not practical.

[coga]

Why would anyone pay money to login?  I understand you're sending to an address and then getting the coins back.  However, there are transaction fees on every send, so you're paying TWICE the transaction fee for every login.

Sure, you could set the transaction fee to 0.  But that's going to seriously delay your ability to login as you wait for the transaction to be added to the block chain.

It's just not practical.

I understand your point, and I agree that it is not practical.

[somebadger]

i love this concept, the fees can be lessend by manual return requests when u get to a certain ballance, but the sending for login will cost a bit too much in fees, and not to mention the wait time for confirmations, without wich makes the system not really reliable.

i guess you could start your own fork then sell btc for your logincoins or something similar then u can abolish the fees ?

[dazedtrader]

This sounds a little bit like HashCash, which was around before Bitcoin and I believe influenced it.