Summary:
-Goal: stop automated dictionary attacks
-Avoid: locking out legitimate users (DOS, customer service costs) 
-Pricing via processing paradigm: user must do some computation when responding 
-Several possible tests to distinguish between human users and computer  
programs (Reverse Turing Tests, RTTs) -characteristics of RTTs:  
-automated generation  
-easy for humans  
-hard for machines (guessing gives same probability of success)  
-small probability of correct guess
-example: ticketmaster, read this string and type it in
-note: they don't need it to be impossible, just to take a lot of  computation 
-Could do an RTT for every attempt
-Observation: users typically use a limited set of computers that are not 
the same computer that a dictionary attack might come from 
-store something that says they were correctly 
logged on from that machine  before, thus eliminating the need to do an RTT for 
that machine every  time -Main Contribution: An algorithm for determining when 
to perform an RTT  during a login session

Pros:
1. Reasonable assumptions about online atacks, i.e.
   concentration on online attacks only.
2. Machine computation of RTT anwers is not assumed proven
   to be hard.
3. Reasonalbe assumptions about user behavior, i.e. limited
   number of computers that users use
4. Protocol is simple to implement:
   a) RTTs are already used
   b) Cookies
   c) Only generate RTTs for a fraction of incorrect logins
5. Ability to tune p - number of RTTs - is beneficial.
6. There is a strategy to deal with dictionary attacks.
7. There is a strategy to deal with cookie theft.
8. Partial analysis of the security of protocol
9. Good argument that their protocol could be adopted
   a) Portability
   b) User-friendliness

Cons:
* The paper details that alternative Reverse Turing Tests to the image-based
  solution presented in the paper are possible, and even suggests in Section
  2.1 an audio-based RTT.  While I agree that such alternative RTTs can
  exist, my concern is that widespread use of the technique described in
  the paper would most likely NOT provide alternatives to image-based
  solutions and that this would have negative impact to visually-impaired
  users.  That is, when developers are under "crunch time" conditions, they
  may not be likely to incorporate alternative RTTs into their solutions
  unless forced to (for example, by ADD laws).

* The paper seems to suggest that the RTT presented to a user is
  deterministic.  If this means that they are always presented with the same
  image, and if the user has difficulty figuring out that particular image,
  the user may always fail to respond correctly when challenged.  A better
  solution might be to present the user with a randomly-generated challenge
  each time.

* Image-based and audio-based RTTs may present difficulties for users with
  limited technology such as text-based browsers (Lynx) or cellphone browsers.

* Since technology continues to improve, it seems that whatever RTT is used
  for the protocol described in this paper, methods for circumvention will
  inevitably be developed.  Therefore, it seems like a better approach to try
  to locate a solution to the broader authentication problem rather than an
  incremental solution.

* The protocol presented in the paper seems simplistic yet the analysis
  performed is more of a "hand waving" level.  It would be nice to see a more
  thorough analysis of the statistics/probabilities involved.

* The solution presented in the paper seems constrained to web-based
  authentication applications.  For example, it seems difficulty or impossible
  to apply it to a console-based login.

* The solution presented in the paper is already in somewhat common use, and
  the real contribution of the paper seems to be the algorithm presented in
  Figure 1 (page 6).  Is this contribution enough to be worthy of an
  entire publication?

Strong Accept: 0
Accept       : 7
Reject       : 4
Strong Reject: 0