<br><br><div class="gmail_quote">On Mon, Mar 21, 2011 at 5:08 PM, Jules <span dir="ltr"><<a href="mailto:Jules@zend.to">Jules@zend.to</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div bgcolor="#ffffff" text="#000000"><div class="im">
<br>
<br>
On 21/03/2011 08:47, Barry Kwok wrote:
</div><div class="im"><blockquote type="cite">2. Request code
<div>Should it be more easier to dictate over phone If use <b>digits </b>instead.
(eg. 5 digits. I think it is secure enough)</div>
<br>
</blockquote></div>
It would need to be a lot more than 5 digits. Imagine what happens
if someone tries to break it with 10,000 PCs all trying 5 numbers
per second, which is quite possible. You need to be proof against
massive-scale attacks like that, or they can and will brute-force
it. I would say 9 digits at least. At which point 3 words are
probably more reliably input.<div class="im"><br>
<pre cols="72"><br></pre></div></div></blockquote><div><br></div><div>I thinkk brute-force attack should be protected by other means instead. eg. fail2ban can block ip address by reading a log file.</div><div><br></div>
<div>-- barry </div></div>