On-line guessing attack