5 ms·

Came here to say this. It is feasible to reconstruct passwords from timing information alone. This has been done against e.g. SSH http://people.eecs.berkeley

Came here to say this. It is feasible to reconstruct passwords from timing information alone. This has been done against e.g. SSH http://people.eecs.berkeley.edu/~daw/papers/ssh-use01.pdf http://people.eecs.berkeley.edu/~daw/papers/ssh-use01.pdf and TLS https://www.schneier.com/blog/archives/2010/03/side-channel_at.html https://www.schneier.com/blog/archives/2010/03/side-channel_...

ryanlol 10y ago
That's a very interesting interpretation of the linked papers. While timing information may make brute force attacks against the passwords easier, it is not feasible to reconstruct passwords based on the timing information exposed by Ebay. It is also worth noting that the ability to perform more efficient brute force searches doesn't really matter in the case of Ebay, as it will not make such attacks feasible over the internet.
- willvarfar 10y ago
  Attacks only get better.
  - tfinniga 10y ago
    Sometimes they stay at exactly the same level forever.
    - willvarfar 10y ago
      Its a classic quote from Bruce Schneier. I should have attributed it. I thought the crowd would get it.
      - sp332 10y ago
        While often attributed to Schneier, he attributes it to the NSA https://www.schneier.com/blog/archives/2011/08/new_attack_on_a_1.html https://www.schneier.com/blog/archives/2011/08/new_attack_on...
  - ryanlol 10y ago
    It is, and will remain impossible to deduce a victims password from such a small timing sample. There simply isn't enough data.
    - willvarfar 10y ago
      I do trust you aren't an Ebay security team? ;) http://www.wired.com/2011/10/iphone-keylogger-spying/ http://www.wired.com/2011/10/iphone-keylogger-spying/ etc.
      - ryanlol 10y ago
        >I do trust you aren't an Ebay security team? ;) Luckily, not my kind of a gig. >http://www.wired.com/2011/10/iphone-keylogger-spying/ http://www.wired.com/2011/10/iphone-keylogger-spying/ etc. This attack depends on being able to identify individual keys so it's not really applicable here. However, a similar attack might be possible here if not for the very small sample size.
        willvarfar 10y ago
        It was guessing pairs of keys. But anyway.

ryanlol 10y ago

That's a very interesting interpretation of the linked papers. While timing information may make brute force attacks against the passwords easier, it is not feasible to reconstruct passwords based on the timing information exposed by Ebay. It is also worth noting that the ability to perform more efficient brute force searches doesn't really matter in the case of Ebay, as it will not make such attacks feasible over the internet.

willvarfar 10y ago
Attacks only get better.
- tfinniga 10y ago
  Sometimes they stay at exactly the same level forever.
  - willvarfar 10y ago
    Its a classic quote from Bruce Schneier. I should have attributed it. I thought the crowd would get it.
    - sp332 10y ago
      While often attributed to Schneier, he attributes it to the NSA https://www.schneier.com/blog/archives/2011/08/new_attack_on_a_1.html https://www.schneier.com/blog/archives/2011/08/new_attack_on...
- ryanlol 10y ago
  It is, and will remain impossible to deduce a victims password from such a small timing sample. There simply isn't enough data.
  - willvarfar 10y ago
    I do trust you aren't an Ebay security team? ;) http://www.wired.com/2011/10/iphone-keylogger-spying/ http://www.wired.com/2011/10/iphone-keylogger-spying/ etc.
    - ryanlol 10y ago
      >I do trust you aren't an Ebay security team? ;) Luckily, not my kind of a gig. >http://www.wired.com/2011/10/iphone-keylogger-spying/ http://www.wired.com/2011/10/iphone-keylogger-spying/ etc. This attack depends on being able to identify individual keys so it's not really applicable here. However, a similar attack might be possible here if not for the very small sample size.
      - willvarfar 10y ago
        It was guessing pairs of keys. But anyway.