3 ms·

I 'time shift' each number in date of birth so neither the day, month, or year are correct. My secret key is the formula I use. For other questions I use answ

by iam-TJ 11y ago

I 'time shift' each number in date of birth so neither the day, month, or year are correct. My secret key is the formula I use. For other questions I use answers that 'belong' to a friend or relative. My secret key is the formula for figuring out who that is.

JoeAltmaier 11y ago
I wonder how many 'bits' those secret keys have? Maybe one or two? E.g. how long to brute force those answers.
- philipov 11y ago
  If it's only 2 bits, you're assuming the attacker already knows that the formula is "Using someone else's information" and that there are only 4 possible people whose information you would use. Even knowing that you're using a formula is a bit of information. The type of formula is potentially thousands of bits of information. An attacker doesn't know whether it's a cipher, or a code, or something more complex, and only then can they begin figuring out the parameters to that formula.
  - JoeAltmaier 11y ago
    Pretty sure lots of people use relatives' info. Very, very few use ciphers in their head. Friend used to have a car with a keycode door lock. He just used 5555 or whatever. I suggested he use the address where the car was parked, or some hash of that. Wouldn't have to remember it! And it would vary some at least.
    - philipov 11y ago
      Well, sure, 8 bits of entropy isn't going to help you much if your password is "password". Those bits only provide the opportunity for randomness. At the end of the day you still have to apply that entropy effectively by picking something that can't be guessed easily. The point is that there are opportunities for people savvy enough to recognize them.
- iam-TJ 11y ago
  My aim isn't to guard against the answers being guessed, it is to deny the operator of the service asking those questions from gathering accurate data about me that may later be exposed. Someone then trying to fraudulently use my identity info, or for any kind of socially engineered attack, would lose out. E.g. calling some financial service provider and trying to get a password reset based on D.O.B, mother's maiden name, or whatever.

by iam-TJ 11y ago

JoeAltmaier 11y ago

I wonder how many 'bits' those secret keys have? Maybe one or two? E.g. how long to brute force those answers.

philipov 11y ago
If it's only 2 bits, you're assuming the attacker already knows that the formula is "Using someone else's information" and that there are only 4 possible people whose information you would use. Even knowing that you're using a formula is a bit of information. The type of formula is potentially thousands of bits of information. An attacker doesn't know whether it's a cipher, or a code, or something more complex, and only then can they begin figuring out the parameters to that formula.
- JoeAltmaier 11y ago
  Pretty sure lots of people use relatives' info. Very, very few use ciphers in their head. Friend used to have a car with a keycode door lock. He just used 5555 or whatever. I suggested he use the address where the car was parked, or some hash of that. Wouldn't have to remember it! And it would vary some at least.
  - philipov 11y ago
    Well, sure, 8 bits of entropy isn't going to help you much if your password is "password". Those bits only provide the opportunity for randomness. At the end of the day you still have to apply that entropy effectively by picking something that can't be guessed easily. The point is that there are opportunities for people savvy enough to recognize them.
iam-TJ 11y ago
My aim isn't to guard against the answers being guessed, it is to deny the operator of the service asking those questions from gathering accurate data about me that may later be exposed. Someone then trying to fraudulently use my identity info, or for any kind of socially engineered attack, would lose out. E.g. calling some financial service provider and trying to get a password reset based on D.O.B, mother's maiden name, or whatever.