5 ms·

I often wish that password entry for things fully under your control (i.e. when there are no retry limits aside from brute computational power) would come with

I often wish that password entry for things fully under your control (i.e. when there are no retry limits aside from brute computational power) would come with limited brute forcing support. Such password dialogs could just let you type your best effort, and they could use the things you type to inform the guessing process; you could fat-finger a character or two, and it would just take a moment longer to log in as it uses the accurate parts of the data to make educated guesses of the password. For old encrypted files, for example, I often don't remember which password or which combination of passwords I might have used, but I can provide all the important bits and a smart program could easily guess the right combination.

eterm 9y ago
It's a protocol, there's no way to rate-limit beyond the mathematics behind the protocol. The author of the blog post could have written their own software to try passphrases if existing software is rate limited.
ktta 9y ago
(offtopic - misunderstood comment. Let's assume the parent comment said 'we should prevent bruteforcing') As the other commenter said, there's nothing you can do to prevent brute forcing. What you can do, is have a very expensive KDF. So for every password you enter the wallet will take a very long time to 'unlock', which is basically the process of deriving the key from the input. 'Expensive KDF' sounds cryptic, but often just having some memory/CPU requirements for an instance of the KDF should suffice. Fun fact: There is a reason why when you enter a wrong password for `su` or `sudo` it seems to take longer to throw the wrong password dialogue than to log you in. That's because the password authentication module (called PAM) artificially delays you to prevent brute forcing. You can go and change it if you want. (I would discourage it) Of course, this won't stop everyone. One can just put the harddrive in a different computer to get the hash of the password and crack it within a day with proper resources. This is the problem with trying to 'stop' bruteforcing at the input level. You must already asssume the attacker has the hash, then the difficulty must be determined. That's the point of people arguing about password hashes (for fun, of course)
- no_protocol 9y ago
  The post you responded to was asking for an easier way to support multiple attempts without having to sit there typing all the nearby variants of a mostly-known passphrase. I'm not sure what part of this post addressed the parent post.
  - ktta 9y ago
    >I often wish that password entry for things fully under your control (i.e. when there are no retry limits aside from brute computational power) would come with limited brute forcing support. This part. I misunderstood the comment. I thought by 'limited brute forcing support' they meant to limit the brute forcing process. The sibling comment also thought the same thing so I didn't doubt it.
- ge96 9y ago
  What do you mean you can't prevent brute forcing? You can count login attempts server side and throw a recaptcha every 5th try say. I could be thinking the wrong space though I don't know what Siacoin is or KDF. edit: after reading... >If you’re not familiar with Siacoin, it’s a cryptocurrency that allows you to rent out your spare hard disk space or buy space from others. Interesting not sure I'd do it, what scale you need for this to be worth something as a leasee (leaser?) That was pretty cool that distance between keys... ahh automation me like, parse out the function/tasks write it out, then let the computer do its magic. Batch processing yeahhhhhhh
  - AgentME 9y ago
    This example with Siacoin is more similar to the situation that you have a file encrypted with a password on your computer than it is similar to a network service that users send their password to in order to log in. For anyone interested in a little more detail: Bitcoin and every decentralized cryptocurrency operates on the concept of a blockchain, which is synchronized to every user (and regularly appended to). Most cryptocurrency blockchains effectively contain a list of (hashes of) public keys known as addresses and currency amounts. You own some currency if you know the private key corresponding to an amount listed in the blockchain, and using that private key you can sign a transaction to send the amount associated with it to another address. (That's the easy half of how Bitcoin and friends work. The other half is the innovative part about getting everyone to agree on the same blockchain even when people create conflicting transactions attempting to double-spend the same money. This involves continuous proof-of-work mining generally. It's not super relevant to anything in OP's post though.) The user in the OP post who had their Siacoin stolen was using a system (often called a "brain wallet") where their private key was generated from a 29-word phrase. Anyone who knew the 29-word phrase could use that to generate the private key and then create a transaction to steal the currency associated with it. If you almost know the 29-word phrase, then you could brute-force it by repeatedly modifying the phrase, generating the private key, and then looking at your copy of the blockchain to see if that private key had any currency associated with it. (Well, actually the brain wallet system uses a checksum like credit card numbers do, so most invalid 29-word phrases just fail the checksum check and don't need to bother checking the blockchain itself, but that doesn't really impact anything about this process.)
Jach 9y ago
IIRC Facebook does something like this, where they actually hash multiple variants of your password when you set it and will accept any of them when you log in.
- no_protocol 9y ago
  Yep! See here: https://news.ycombinator.com/item?id=13426544 https://news.ycombinator.com/item?id=13426544
anishathalye 9y ago
Some people (e.g. Facebook) do this already. And it turns out that this doesn't really impact security all that much! Here's a recent research paper on the topic: pASSWORD tYPOS and How to Correct them Securely - http://www.ieee-security.org/TC/SP2016/papers/0824a799.pdf http://www.ieee-security.org/TC/SP2016/papers/0824a799.pdf
- laser 9y ago
  Does Facebook do anything beyond capitalization correction?
  - deleted 9y ago
    [deleted]
  - zulln 9y ago
    Think they remove ending space.
dacox 9y ago
For UX this would be nice. However, many applications that encrypt locally (like KeePass, etc.) perform key stretching, which would make this take quite a long time.

eterm 9y ago

It's a protocol, there's no way to rate-limit beyond the mathematics behind the protocol. The author of the blog post could have written their own software to try passphrases if existing software is rate limited.

ktta 9y ago

(offtopic - misunderstood comment. Let's assume the parent comment said 'we should prevent bruteforcing') As the other commenter said, there's nothing you can do to prevent brute forcing. What you can do, is have a very expensive KDF. So for every password you enter the wallet will take a very long time to 'unlock', which is basically the process of deriving the key from the input. 'Expensive KDF' sounds cryptic, but often just having some memory/CPU requirements for an instance of the KDF should suffice. Fun fact: There is a reason why when you enter a wrong password for `su` or `sudo` it seems to take longer to throw the wrong password dialogue than to log you in. That's because the password authentication module (called PAM) artificially delays you to prevent brute forcing. You can go and change it if you want. (I would discourage it) Of course, this won't stop everyone. One can just put the harddrive in a different computer to get the hash of the password and crack it within a day with proper resources. This is the problem with trying to 'stop' bruteforcing at the input level. You must already asssume the attacker has the hash, then the difficulty must be determined. That's the point of people arguing about password hashes (for fun, of course)

no_protocol 9y ago
The post you responded to was asking for an easier way to support multiple attempts without having to sit there typing all the nearby variants of a mostly-known passphrase. I'm not sure what part of this post addressed the parent post.
- ktta 9y ago
  >I often wish that password entry for things fully under your control (i.e. when there are no retry limits aside from brute computational power) would come with limited brute forcing support. This part. I misunderstood the comment. I thought by 'limited brute forcing support' they meant to limit the brute forcing process. The sibling comment also thought the same thing so I didn't doubt it.
ge96 9y ago
What do you mean you can't prevent brute forcing? You can count login attempts server side and throw a recaptcha every 5th try say. I could be thinking the wrong space though I don't know what Siacoin is or KDF. edit: after reading... >If you’re not familiar with Siacoin, it’s a cryptocurrency that allows you to rent out your spare hard disk space or buy space from others. Interesting not sure I'd do it, what scale you need for this to be worth something as a leasee (leaser?) That was pretty cool that distance between keys... ahh automation me like, parse out the function/tasks write it out, then let the computer do its magic. Batch processing yeahhhhhhh
- AgentME 9y ago
  This example with Siacoin is more similar to the situation that you have a file encrypted with a password on your computer than it is similar to a network service that users send their password to in order to log in. For anyone interested in a little more detail: Bitcoin and every decentralized cryptocurrency operates on the concept of a blockchain, which is synchronized to every user (and regularly appended to). Most cryptocurrency blockchains effectively contain a list of (hashes of) public keys known as addresses and currency amounts. You own some currency if you know the private key corresponding to an amount listed in the blockchain, and using that private key you can sign a transaction to send the amount associated with it to another address. (That's the easy half of how Bitcoin and friends work. The other half is the innovative part about getting everyone to agree on the same blockchain even when people create conflicting transactions attempting to double-spend the same money. This involves continuous proof-of-work mining generally. It's not super relevant to anything in OP's post though.) The user in the OP post who had their Siacoin stolen was using a system (often called a "brain wallet") where their private key was generated from a 29-word phrase. Anyone who knew the 29-word phrase could use that to generate the private key and then create a transaction to steal the currency associated with it. If you almost know the 29-word phrase, then you could brute-force it by repeatedly modifying the phrase, generating the private key, and then looking at your copy of the blockchain to see if that private key had any currency associated with it. (Well, actually the brain wallet system uses a checksum like credit card numbers do, so most invalid 29-word phrases just fail the checksum check and don't need to bother checking the blockchain itself, but that doesn't really impact anything about this process.)

Jach 9y ago

IIRC Facebook does something like this, where they actually hash multiple variants of your password when you set it and will accept any of them when you log in.

no_protocol 9y ago
Yep! See here: https://news.ycombinator.com/item?id=13426544 https://news.ycombinator.com/item?id=13426544

anishathalye 9y ago

Some people (e.g. Facebook) do this already. And it turns out that this doesn't really impact security all that much! Here's a recent research paper on the topic: pASSWORD tYPOS and How to Correct them Securely - http://www.ieee-security.org/TC/SP2016/papers/0824a799.pdf http://www.ieee-security.org/TC/SP2016/papers/0824a799.pdf

laser 9y ago
Does Facebook do anything beyond capitalization correction?
- deleted 9y ago
  [deleted]
- zulln 9y ago
  Think they remove ending space.

dacox 9y ago

For UX this would be nice. However, many applications that encrypt locally (like KeePass, etc.) perform key stretching, which would make this take quite a long time.