3 ms·
Don't trust client input! The random number would have to be sent from the server, else the same hash could be used every time. Also MD5 can be easily done on
by Jabbles 16y ago
Don't trust client input!
The random number would have to be sent from the server, else the same hash could be used every time.
Also MD5 can be easily done on an FPGA at hundreds of millions of tests a second. Other algorithms might be more effective, particularly those which attempt to use large amounts of memory.
Nice idea though.
- underwater 16y agoNot necessarily. You store which random number you sent to the client in the session on the server. Once it's been solved you invalidate it.
- tomstuart 16y agoHow do you know that the response really is the smallest such integer, rather than a precomputed one (e.g. the largest int with a hash beginning "0000")?
- JoachimSchipper 16y agoYou don't (have to) care about "the smallest", just "any integer with a hash beginning with 0000".
- tomgallard 16y agoBut once the spamming machine has worked that out once, they can submit the same integer every time. It would be better if the server sent a request saying send me an integer which has a hash beginning with npqr where n, p q and r are all random characters.