What if, when you entered a password, three things were sent back to the server?
- A password hash.
- A list of the times taken between keypress events for the password, hashed or something.
- Some identifying information for the computer, plugins, whatever.
The server could also check the times between keypresses in the password for relatively spaced times in the way the user normally enters the password, providing a fingerprint for a particular user.
Suppose it normally takes me 30ms to reach from "F" to "T", and fifteen to get from "O" to "."; if the password was entered differently the user should be redirected to a secondary question page; either they broke a hand, or someone else entered their password.
Think of it as non-random password screening. It would stop bots in their tracks, and would create only a small problem for users.
No comments:
Post a Comment