9 ms·

This is a decent article with a click-batey title. The argument that it's worse than paintext hinges on you both using a weak password and using the same passw

This is a decent article with a click-batey title. The argument that it's worse than paintext hinges on you both using a weak password and using the same password for something else. If you don't do either of those things then it's much better than plaintext, although technically if you use the same strong password for something else then you may have weakened the password by using it for old-format ssh ... but it still has to be brute forced.

lvh 8y ago
If you select from a 10k word list, you get 13.3 bits of entropy per word. 4 of those get you 53 bits of entropy. One p3.16xlarge does 450GH/s. So, as a first order approximation: 253 / (450E9) = 2E4 or about 6 hours. Sure: you don’t get to keep that performance, but we’re talking a day. What kind of passwords do you have that make it “much better”? Or are you saying that already counts?
- nebulous1 8y ago
  If you're asking what I'm using myself, I use 5 random words from the COED (240,000 words). If you want to stick to a 10,000 word list you can just up the word count. Every word you add makes it 10,000 times stronger.
  - lvh 8y ago
    Good for you -- but I hope you'll agree that even 4*rand(10k) is a pretty gracious assumption for password quality. The argument is not "under literally all circumstances is it worse", but just rather, "it's worse". For that argument to hold, it just has to be plausible worse at least on average. All empirical data we have on password quality points in that direction.
    - nebulous1 8y ago
      > but I hope you'll agree that even 4*rand(10k) is a pretty gracious assumption for password quality I do. However, for it to be "worse" than plaintext you still need to be using it somewhere else, and (previously unmentioned) for the attacker to have a feasible way of attacking the other use. For instance if it's your desktop password, an attacker may have no way of leveraging that (not that I'm saying this overlap is a good thing security-wise). Whereas if they have your unencrypted ssh key then they 100% have your ssh key, no work required, no AWS instance, no cost. I don't want to get too bogged down in this. I was using the old format, and I've now changed, so thank you!
- ascar 8y ago
  53 bits of entropy is basically the same entropy as a 9 character alphanumeric password. That's not a strong password to begin with and makes this calculation senseless. Redo that calculation with 71 bits (12 char alphanumeric, still not really long) and it takes close to 200 years, thus making it impractible. The problem with these word lists is, that they yield rather low entropy compared to random strings, when the attacker knows that a word list is used. That's because one word has just a little bit more entropy than 2 alphanumeric characters.
  - lvh 8y ago
    Do you have evidence that passwords for SSH keys are as good as you claim?
    - petee 8y ago
      ...conversely, do you have evidence most people pick their passwords from a 10k word list? And the Oxford dictionary has ~171k words, so not sure where a 10k list even comes into play
      - angry_octet 8y ago
        I think haveibeenpwned is good evidence people choose weak passwords and reuse them. DICEWARE uses ~8k words, chosen so that people can remember and spell them.
        nebulous1 8y ago
        haveibeenpwned is great! but it doesn't have anything to do with password strength. it just tells you if your password hash has been leaked/stolen. edit: seems I'm wrong and they do actually have a passwords section: https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords
        petee 8y ago
        haveibeenpwned provides no such statistic, other than reuse (75% of original set) -- a breached password is unrelated to its strength. The simple fact that the HIBP password list contains 512 MILLION unique passwords...
daxterspeed 8y ago
I suppose the author meant that the illusion of proper encryption is worse than simply storing the password as plaintext - especially when the encryption is presented as an opaque string instead of clearly stating that it's using MD5.
- whyever 8y ago
  > I suppose the author meant that the illusion of proper encryption is worse than simply storing the password as plaintext In this case, the alternative would be not storing the password at all. Note that "plaintext" in the title refers to the SSH key and not the password protecting the SSH key.

lvh 8y ago

If you select from a 10k word list, you get 13.3 bits of entropy per word. 4 of those get you 53 bits of entropy. One p3.16xlarge does 450GH/s. So, as a first order approximation: 253 / (450E9) = 2E4 or about 6 hours. Sure: you don’t get to keep that performance, but we’re talking a day. What kind of passwords do you have that make it “much better”? Or are you saying that already counts?

nebulous1 8y ago
If you're asking what I'm using myself, I use 5 random words from the COED (240,000 words). If you want to stick to a 10,000 word list you can just up the word count. Every word you add makes it 10,000 times stronger.
- lvh 8y ago
  Good for you -- but I hope you'll agree that even 4*rand(10k) is a pretty gracious assumption for password quality. The argument is not "under literally all circumstances is it worse", but just rather, "it's worse". For that argument to hold, it just has to be plausible worse at least on average. All empirical data we have on password quality points in that direction.
  - nebulous1 8y ago
    > but I hope you'll agree that even 4*rand(10k) is a pretty gracious assumption for password quality I do. However, for it to be "worse" than plaintext you still need to be using it somewhere else, and (previously unmentioned) for the attacker to have a feasible way of attacking the other use. For instance if it's your desktop password, an attacker may have no way of leveraging that (not that I'm saying this overlap is a good thing security-wise). Whereas if they have your unencrypted ssh key then they 100% have your ssh key, no work required, no AWS instance, no cost. I don't want to get too bogged down in this. I was using the old format, and I've now changed, so thank you!
ascar 8y ago
53 bits of entropy is basically the same entropy as a 9 character alphanumeric password. That's not a strong password to begin with and makes this calculation senseless. Redo that calculation with 71 bits (12 char alphanumeric, still not really long) and it takes close to 200 years, thus making it impractible. The problem with these word lists is, that they yield rather low entropy compared to random strings, when the attacker knows that a word list is used. That's because one word has just a little bit more entropy than 2 alphanumeric characters.
- lvh 8y ago
  Do you have evidence that passwords for SSH keys are as good as you claim?
  - petee 8y ago
    ...conversely, do you have evidence most people pick their passwords from a 10k word list? And the Oxford dictionary has ~171k words, so not sure where a 10k list even comes into play
    - angry_octet 8y ago
      I think haveibeenpwned is good evidence people choose weak passwords and reuse them. DICEWARE uses ~8k words, chosen so that people can remember and spell them.
      - nebulous1 8y ago
        haveibeenpwned is great! but it doesn't have anything to do with password strength. it just tells you if your password hash has been leaked/stolen. edit: seems I'm wrong and they do actually have a passwords section: https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords
      - petee 8y ago
        haveibeenpwned provides no such statistic, other than reuse (75% of original set) -- a breached password is unrelated to its strength. The simple fact that the HIBP password list contains 512 MILLION unique passwords...

daxterspeed 8y ago

I suppose the author meant that the illusion of proper encryption is worse than simply storing the password as plaintext - especially when the encryption is presented as an opaque string instead of clearly stating that it's using MD5.

whyever 8y ago
> I suppose the author meant that the illusion of proper encryption is worse than simply storing the password as plaintext In this case, the alternative would be not storing the password at all. Note that "plaintext" in the title refers to the SSH key and not the password protecting the SSH key.