4 ms·

This is the false sense of security through obscurity. Given the simple algorithm and without any entropy, it will be trivial to crack the password if the hacke

This is the false sense of security through obscurity. Given the simple algorithm and without any entropy, it will be trivial to crack the password if the hacker has your multiple passwords. This is very possible since you are sticking to the same algorithm for every website but you don't know which website will just store the plain text of the password. One can easily link you among different websites with your username or email.

usrusr 9y ago
> Given the simple algorithm and without any entropy, it will be trivial to crack the password if the hacker has your multiple passwords. If. Depends a lot on how easy that attacker can identify those accounts as belonging to one set. Easy when they all go to the same email, but deep in the realm of individually targeted attacks if there is a layer of redirection. It's a tradeoff, password managers come at the cost of making their users part of a very high value dragnet target. I guess the proper way to do it would be to augment managed passwords with a brain-based component. That, and stuffing the password manager with a few canary accounts on high-value sites that send out login notifications.
- donald123 9y ago
  It would be pretty easy to identify accounts for same users. Most people use same email or username on most of their websites. The point of password managers are to have true different password for different site and users don't need to remember it. For the inconvenience the author has, there are other secure ways to handle that, no need to sacrifice security for convenience. For example, to have a usb drive with portable password manager installed.
jpfed 9y ago
This threat only holds for dedicated attackers. 1. They have to have multiple passwords to have a chance to derive the algorithm. 2. They also need to somehow think it's worth their time to reverse the algorithm instead of just going with lower-hanging fruit.
- donald123 9y ago
  This is not necessarily true. Attackers with multiple sites' passwords can link users and look at their passwords. When they see some similarity of the passwords for the same user, it would take least effort for them to crack the password. Even if it only applies to dedicated attackers, think about the consequence, once the attacker cracks your password, he knows your algorithm, all your passwords will be exposed. And the point is the method is not more secure than using the same password for multiple sites.
  - jpfed 9y ago
    Yes, it really is more secure than exact re-use. Attackers that just try the exact same password on multiple sites on first discovery will be thwarted by algorithmically derived passwords. I'm not ruling out that there will be attackers that try to harvest passwords from multiple sites, join those sites by username or email, then try some ML to derive people's password algorithms. But there is a whole class of attackers that just won't bother with that level of sophistication. If your algorithm is any good, you're already not the slowest person running from the bear (cf. easy passwords or exact-password-reuse).
    - donald123 9y ago
      Having less hackers or taking hackers a little more effort to crack the password do not make it more secure in any ways. This is security through obscurity. Do you think the hackers will stop like a bear when they crack the first password? If password can be cracked, they are insecure, no matter it takes the hacker 10 minutes or 10 hours. And it does not take ML to derive these simple algorithms at all. People may think their password algorithm is good, but it lacks the fundamentals of cryptography. It's really just a puzzle you play with the attacker.
- pixl97 9y ago
  3. With Yahoo leaking billions of accounts, and hundreds of other services leaking 10's of millions of accounts, your passwords are already out there. 4. Someone makes a John the Ripper/Hashcat plugin that searches password dumps for common usernames/email addresses and attempts to determine if the password is based on an algorithm. 5. With advances in NLP AI, this will just get easier in the future.

usrusr 9y ago

> Given the simple algorithm and without any entropy, it will be trivial to crack the password if the hacker has your multiple passwords. If. Depends a lot on how easy that attacker can identify those accounts as belonging to one set. Easy when they all go to the same email, but deep in the realm of individually targeted attacks if there is a layer of redirection. It's a tradeoff, password managers come at the cost of making their users part of a very high value dragnet target. I guess the proper way to do it would be to augment managed passwords with a brain-based component. That, and stuffing the password manager with a few canary accounts on high-value sites that send out login notifications.

donald123 9y ago
It would be pretty easy to identify accounts for same users. Most people use same email or username on most of their websites. The point of password managers are to have true different password for different site and users don't need to remember it. For the inconvenience the author has, there are other secure ways to handle that, no need to sacrifice security for convenience. For example, to have a usb drive with portable password manager installed.

jpfed 9y ago

This threat only holds for dedicated attackers. 1. They have to have multiple passwords to have a chance to derive the algorithm. 2. They also need to somehow think it's worth their time to reverse the algorithm instead of just going with lower-hanging fruit.

donald123 9y ago
This is not necessarily true. Attackers with multiple sites' passwords can link users and look at their passwords. When they see some similarity of the passwords for the same user, it would take least effort for them to crack the password. Even if it only applies to dedicated attackers, think about the consequence, once the attacker cracks your password, he knows your algorithm, all your passwords will be exposed. And the point is the method is not more secure than using the same password for multiple sites.
- jpfed 9y ago
  Yes, it really is more secure than exact re-use. Attackers that just try the exact same password on multiple sites on first discovery will be thwarted by algorithmically derived passwords. I'm not ruling out that there will be attackers that try to harvest passwords from multiple sites, join those sites by username or email, then try some ML to derive people's password algorithms. But there is a whole class of attackers that just won't bother with that level of sophistication. If your algorithm is any good, you're already not the slowest person running from the bear (cf. easy passwords or exact-password-reuse).
  - donald123 9y ago
    Having less hackers or taking hackers a little more effort to crack the password do not make it more secure in any ways. This is security through obscurity. Do you think the hackers will stop like a bear when they crack the first password? If password can be cracked, they are insecure, no matter it takes the hacker 10 minutes or 10 hours. And it does not take ML to derive these simple algorithms at all. People may think their password algorithm is good, but it lacks the fundamentals of cryptography. It's really just a puzzle you play with the attacker.
pixl97 9y ago
3. With Yahoo leaking billions of accounts, and hundreds of other services leaking 10's of millions of accounts, your passwords are already out there. 4. Someone makes a John the Ripper/Hashcat plugin that searches password dumps for common usernames/email addresses and attempts to determine if the password is based on an algorithm. 5. With advances in NLP AI, this will just get easier in the future.