Puzzle for security/spam psychos

Coffee Lounge
21

Title of post checks out. :rofl:

2 Likes
22

Over? attention to detail.

1 Like
23

I always go with a simple rule when it comes to security: if I thought about it there are people already doing it.

Donā€™t show messages on the frontend(or on the server response) if an account doesnā€™t exist. Donā€™t tell people if the error on the login form is due to the email or the password. These are already being exploited by hackers/spammers/suckers.

I just went psycho thinking what if they just analyse the response time? Ergo probably itā€™s already being done.

1 Like
24

Iā€™m still trying to wrap my pea brain head around this. But it does sound like an interesting concept. :beers:

1 Like
25

Time-based blind SQL injection

I was kind of thinking about that, but a fixed 200 ms delay would be easy to detect :laughing:

(no SQL injection here though in this puzzle scenario)

1 Like
26

I thought about randomising it a bit but given that the server already will add overhead and we have to account network latency I though it would just be enough to offset the thing by a bit. In a DB context with the ability to run queries directly on it Iā€™m assuming itā€™s easier to figure if certain data exists.

27

Yep, itā€™s never going to be exactly 200ms so I wouldnā€™t bother randomising itā€¦ unless you go for a wide range like 200-500ms.