Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

7
  • 9
    You want a potential attacker to have up to a 1% chance of guessing a token? Hmmm, methinks an couple orders of magnitude need to be added to your numbers for most of us to be comfortable. I haven't done the math yet but that's not a base number I would use. Commented Jun 3, 2014 at 7:07
  • 5
    sorry, but your math and assumptions don't seem to make sense. For example, why do you assume an attacker can send only what Facebook receives? Why are you counting tokens for active users, and why 5 minutes? The 1% also seems a bit weird, as @Caleb mentioned. While it really is super important to look at the math of these things (more developers should do that!), I think you're going about it the wrong way. Commented Jun 3, 2014 at 7:43
  • At this point your question is a bit of a moving target. Please don't use questions as an ongoing discussion as your understanding of an issue progresses. I answered the original question, now you've changed it to the point were it would require an entirely different answer. It would be more helpful for everybody if you would focus the question on one issue, then if you have more questions after that in answered, ask a focused question on the new issue. Commented Jun 3, 2014 at 7:47
  • 3
    @AviD: actually I think using Facebook's traffic is fairly ingenious. Most websites can't process anything like as many requests as Facebook does, so for most websites that rate of attempts would naturally cross the line from a brute-force attack on the token into a DoS ;-) That's not to say I like the rest of the analysis, though. In particular if there really were a 1% chance of an attack succeeding in 5 minutes then you'd have to expect that form of attack to succeed in about 500 minutes unless otherwise stopped. Commented Jun 3, 2014 at 9:26
  • The cost of using 130 bit tokens is relatively small. Why not crush that 1% chance into oblivion? What if increases in network and computing power make much larger attacks possible in the future? Commented Jun 3, 2014 at 17:45