3 ms·
A possible mitigation of the obvious problem (the pattern itself) is instead to use a hash function on some aspect of what you're trying to log in to: a hash of
by a3n 11y ago
A possible mitigation of the obvious problem (the pattern itself) is instead to use a hash function on some aspect of what you're trying to log in to: a hash of the main domain, the human name, whatever. That way if a password is compromised, it may look like a common pattern is being used, but the "random" part of one site's password won't do any good on another site.
The challenge being to implement a hash app everywhere you might be that will generate the correct hash. Maybe a very simple mental hash function would be enough; mass attacks would probably be foiled, and individual attackers may be too lazy to bother figuring out the hash.
There remains the problem of changing the password due to some necessity, like policy or compromise.
EDIT: If this was app-based, then each time you change a password, the app would record that fact, and incorporate it into the hashing data, so that a different hash is generated. The problem then being synchronizing that fact among all your installations of the app. And if you were using a mental hash, I don't know how you'd remember this across all your logins; possibly some central piece of data that you could easily look up, to see that you've changed your password one or two or N times, that is easy to incorporate into the mental hash.
- pavel_lishin 11y agoThis is good brainstorming, but I'm getting tired just thinking about all that mental complexity. I would rather take my chances with Lastpass than keep a complex mental list of how many places I've reset my password at so far.
- akkartik 11y agoI've actually been using this approach for the past 12 years. There used to be an old firefox plugin called Password Composer (http://web.archive.org/web/*/http://jlpoutre.home.xs4all.nl/BoT/Javascript/PasswordComposer/password_composer_form.html http://web.archive.org/web/*/http://jlpoutre.home.xs4all.nl/...) which would let you type in your master password into firefox, append the website domain, take a digest of the result and truncate to 8 characters before sending to the website. Over the years, I replaced this plugin with a simple 5-line script so I can reproduce my passwords from anywhere, strengthened the hash function from SHA-1 to bcrypt, and also added a configurable password length so I can gradually grow passwords over time as computers grow more powerful. Here's my solution: http://akkartik.name/pc http://akkartik.name/pc Regarding other comments in this thread about managing exceptions to the scheme over time, I have a simple solution: I let my browser save my passwords. I think this is a reasonable trade-off; the dominant threat online today is not somebody gaining physical access to your devices, but random script kiddies brute-forcing passwords using stolen hashes. Tl;dr - use my script to generate passwords, use your browser to remember passwords, and the complexity is quite manageable. Edit - sorry, I forgot that that 5-line script calls another 5-line script: http://akkartik.name/bcrypt_digest http://akkartik.name/bcrypt_digest. One potential gotcha I realized recently is that it uses the bcrypt encryption scheme rather than the well-known digesting algorithm. The two share a common kernel, from what I can tell, though there are significant differences. There might by cryptographic implications to using an encryption scheme for digesting; I'm not an expert. Hopefully the fact that this is a bespoke arrangement being used by a tiny population will keep anyone from hacking me :)
- pavel_lishin 11y agoIf you're storing your passwords in the browser anyway, why not just generate random, arbitrary passwords anyway?
- akkartik 11y agoIt gives me a way to figure out my password on a strange system. Admittedly this use case is growing less common with the ubiquity of personal devices and sync.
- a3n 11y agoSo as your browser stored passwords pass through (and rest at) the server, waiting to be synced to another browser or device, you have passwords "up there." Are they in the clear? Are the encrypted well enough?
- akkartik 11y agohttps://blog.mozilla.org/services/2014/04/30/firefox-syncs-new-security-model https://blog.mozilla.org/services/2014/04/30/firefox-syncs-n... Your point is well-taken that I'm just replacing one external service with another, so the difference isn't large enough to convince anyone to switch. My original response in this thread was just to point out prior work relevant to the brainstorming above.