Is it possible make brute-force attacks ineffective by giving false positive answers to failed log-in attempts?

The answer always depends on your threat model. Security is always woven into a balance between security and usability. Your approach inconveniences the hackers trying to break into the account, but also inconveniences a user who merely mistypes their password. If the fake account is believable enough to fool an attacker, it may also be believable enough to fool a valid user. That could be very bad.

This may be desirable in extremely high risk environments. If you had to store nuclear secrets out in the open on the internet, having every failed password lead you to an account that has access to fake documents which don't actually reveal national secrets could be quite powerful. However, for most cases it is unnecessary.

You also have to consider the alternatives. A very popular approach is to lock the account out after N attempts, which basically stops all brute force attempts cold, and has usability behaviors that most users are willing to accept.


Fooling an attacker with false positives isn't a bad idea, and it's not new. The following may interest you.

Cryptographic Camouflage

CA technologies has patented a technology known as Cryptographic Camouflage.

A sensitive point in public key cryptography is how to protect the private key. We outline a method of protecting private keys using cryptographic camouflage. Specifically, we do not encrypt the private key with a password that is too long for exhaustive attack. Instead, we encrypt it so that only one password will decrypt it correctly, but many passwords will decrypt it to produce a key that looks valid enough to fool an attacker. For certain applications, this method protects a private key against dictionary attack, as a smart card does, but entirely in software.

This isn't exactly what you are talking about (they're protecting a key, not access) but the concept is the same. You foil a brute force attack by making it difficult or impossible to determine if you've actually cracked the code.

Mousetrap

In 1984, Michael Crichton (author of Andromeda Strain and many others) wrote a short story centered around a hacker who thought he was stealing top secret files. He had guessed the right password, but unbeknownst to him, the computer was actually authenticating him not by looking at his password but at the speed and manner in which he used the keyboard and mouse-- sort of a biometric authentication mechanism. He failed authentication. But the computer didn't tell him he failed-- instead, it presented him with a false copy of the secret documents, which he then downloaded and attempted to sell on the black market.

Again, this is not exactly the same as what you are asking, but it demonstrates (in fiction, anyway) the use of false positives to thwart an attack.


To give you a straight answer, yes, it is possible to reduce the effectiveness of brute-force attacks and it can be done the way you suggested, but shouldn't. You can get very similar results just by implementing timing delays between each failed attempt and the next guess. Also, (just for your knowledge) very sophisticated and similar technologies have already been designed and implemented for this exact thing. Products like Canary, Honey Pots and Honey Docs all deliver similar things like fake environments, devices, servers, accounts etc.