From: Alex Young <alex@...>
Date: 2007-07-05T18:12:50+09:00
Subject: Re: [ANN] flatulent-0.0.1 ascii captcha for the masses

ara.t.howard wrote:
>  - image has an encoded timebomb in it: attacker has only 60s for post.  
> this just rules out brute force attacks.

Only naive ones...  The brute force attack that still works is a 
birthday attack.  Using that they can try attacks as fast as they can 
generate *new* captchas - you expect a collision every 1.2*sqrt(n) 
attempts, where n is the size of your keyspace.  That's probably OK for 
"captcha per comment" sites, but it's dangerous for "captcha per 
account" sites.

-- 
Alex