6 ms·

What's more likely - that the bank gets hacked, or that you install a keylogger? Also there are ways to implement this without keeping the whole password in pl

by ajuc 8y ago

What's more likely - that the bank gets hacked, or that you install a keylogger? Also there are ways to implement this without keeping the whole password in plaintext/reversibly encrypted. One example I just thought of: Ask for 75% of the password each time, remember random 1/3rd of that (25% of full password) till the next login together with the hash, and on the next login ask for all the letters you haven't remembered (and fill the ones you remembered, then hash everything and compare). You can adjust the percentages as needed if having 25% of the password in clear text is too insecure.

IAmLiterallyAB 8y ago
So you're still storing part of the plaintext... That's still insecure Plus, the keylogger could just collect a few logins and it completely defeats the whole thing, so it doesn't help anyway. It's just terrible, it makes everything worse
- ajuc 8y ago
  25% of the password. Shouldn't matter that much. And you can change the percentages to for example 10% (asking for 90% of the password each time). Demand slightly longer passwords if that's a big problem. Hm, actually instead of masking the password to defeat keyloggers they could also just permutate the characters. So that you have to enter password in different order each time. But usability would suck so much :) I prefer the masking. Also - universal keylogger wouldn't know which characters of the passwords you were asked for. They would need to make a keylogger designed for this bank website so it can understand which characters you provide. And they would need to update the keylogger with updates on the login website (which preasumably would be written in a way that makes it hard to know which characters these are - for example with randomly generated ids of the input fields and provided in random order then positioned with javascript). I know - security by obscurity. But it does help.
  - rhinoceraptor 8y ago
    I'm sure it will help the bank's helpdesk job security, but not much else. Remembering a specific character of a password is not easy to do, so people will probably type it into notepad and then count to get the right one anyways. TOTP is much more usable, and probably more secure than inventing your own ridiculous partial password scheme.
    - ajuc 8y ago
      You just spell your password in your mind and when the character is needed you press the key, when it's not needed you don't. The login site looks like this: [x] [ ] [x] [ ] [ ] [ ] [ ] [x] [ ] [ ] [ ] [x] [ ] And when you press a key it jumps to the next empty field.
      - gbear605 8y ago
        I don’t spell passwords in my mind; I have muscle memory for the password.
        ajuc 8y ago
        Well, yes, it's slower. But not by much. A few seconds.
        gbear605 8y ago
        Some of my passwords I have memorized only as muscle memory. Without going into too much detail, if I didn’t have a qwerty keyboard, I wouldn’t be able to enter it without a couple minutes of thinking “okay, this key is there on a qwerty keyboard...”
        cbsks 8y ago
        I have exactly the same issue with my passwords. I can remember what the letters, numbers, and symbols are, but I can only remember which letters are uppercase by typing it out on a keyboard.
inetknght 8y ago
> What's more likely - that the bank gets hacked, or that you install a keylogger? Given the (apparent) lack of security for the bank, I'd say the former. IF the bank was actually secure, then sure it'd be more likely for me to have a keylogger. > Also there are ways to implement this without keeping the whole password in plaintext/reversibly encrypted Maybe. > One example I just thought of: Ask for 75% of the password each time, remember random 1/3rd of that (25% of full password) till the next login together with the hash, and on the next login ask for all the letters you haven't remembered (and fill the ones you remembered, then hash everything and compare). I challenge you to really think about what you're proposing to do. I think it's far more convoluted: it does not solve the keylogger problem and adds complexity to both the client and the server. If you think I'm wrong, then write it up in a spec and show us.
- ajuc 8y ago
  > If you think I'm wrong, then write it up in a spec and show us. Sure. It's fun. On password creation: 0.0. demand 25% longer passwords from users than considered safe 0.1. along with the hash of the whole password remember a randomly choosen 25% of the characters of the password and their positions (in clear text or reversibly encrypted) On each login: 1.0. ask only for the characters in positions you haven't remembered 1.1. server-side fill the positions you remembered 1.2. hash the result and see if it matches If hash matches: 2.0. randomly choose 1/3rd of the freshly provided positions and remember them in clear text on server replacing the previous ones 2.1. give access If hash doesn't match: 3.0. deny access, don't change anything on server If I understand correctly - to get the whole password keylogger must be specific to this bank site (to understand which characters are provided), and must be active on at least 4 logins. In my book that's a big improvement. And I can imagine writing the login page in a way that makes parsing it in keylogger to understand which characters are masked.
  - dpark 8y ago
    If you only remember 25% of the characters, then you have to ask for 75% of the characters to generate the full hash. Asking for 75% of the characters defeats the purported reasons for partial password auth.
amingilani 8y ago
> What's more likely - that the bank gets hacked, or that you install a keylogger? The bank gets hacked. I say this with the utmost certainty because while I haven't been hacked since I started behaving securely at 15 years old, my bank that uses partial passwords was recently hacked. I live in Pakistan, a lot of banks were hacked 2018-2019. I also complained to them about saving passwords in plaintext. They never replied. Every bank in my country is terrible.
munchbunny 8y ago
Considering that password databases are getting leaked on a regular basis at this point, depending on any specific password database not getting leaked is a pretty bad bet.
marcosdumay 8y ago
My bank has been hacked (affecting my account) twice since I started using it, but I'm yet to see any effect of a successful attack against my machines...
cryptonector 8y ago
How many users get compromised if a bank gets compromised vs. if one user installs a keylogger?

by ajuc 8y ago

IAmLiterallyAB 8y ago

So you're still storing part of the plaintext... That's still insecure Plus, the keylogger could just collect a few logins and it completely defeats the whole thing, so it doesn't help anyway. It's just terrible, it makes everything worse

ajuc 8y ago
25% of the password. Shouldn't matter that much. And you can change the percentages to for example 10% (asking for 90% of the password each time). Demand slightly longer passwords if that's a big problem. Hm, actually instead of masking the password to defeat keyloggers they could also just permutate the characters. So that you have to enter password in different order each time. But usability would suck so much :) I prefer the masking. Also - universal keylogger wouldn't know which characters of the passwords you were asked for. They would need to make a keylogger designed for this bank website so it can understand which characters you provide. And they would need to update the keylogger with updates on the login website (which preasumably would be written in a way that makes it hard to know which characters these are - for example with randomly generated ids of the input fields and provided in random order then positioned with javascript). I know - security by obscurity. But it does help.
- rhinoceraptor 8y ago
  I'm sure it will help the bank's helpdesk job security, but not much else. Remembering a specific character of a password is not easy to do, so people will probably type it into notepad and then count to get the right one anyways. TOTP is much more usable, and probably more secure than inventing your own ridiculous partial password scheme.
  - ajuc 8y ago
    You just spell your password in your mind and when the character is needed you press the key, when it's not needed you don't. The login site looks like this: [x] [ ] [x] [ ] [ ] [ ] [ ] [x] [ ] [ ] [ ] [x] [ ] And when you press a key it jumps to the next empty field.
    - gbear605 8y ago
      I don’t spell passwords in my mind; I have muscle memory for the password.
      - ajuc 8y ago
        Well, yes, it's slower. But not by much. A few seconds.
        gbear605 8y ago
        Some of my passwords I have memorized only as muscle memory. Without going into too much detail, if I didn’t have a qwerty keyboard, I wouldn’t be able to enter it without a couple minutes of thinking “okay, this key is there on a qwerty keyboard...”
        cbsks 8y ago
        I have exactly the same issue with my passwords. I can remember what the letters, numbers, and symbols are, but I can only remember which letters are uppercase by typing it out on a keyboard.

inetknght 8y ago

> What's more likely - that the bank gets hacked, or that you install a keylogger? Given the (apparent) lack of security for the bank, I'd say the former. IF the bank was actually secure, then sure it'd be more likely for me to have a keylogger. > Also there are ways to implement this without keeping the whole password in plaintext/reversibly encrypted Maybe. > One example I just thought of: Ask for 75% of the password each time, remember random 1/3rd of that (25% of full password) till the next login together with the hash, and on the next login ask for all the letters you haven't remembered (and fill the ones you remembered, then hash everything and compare). I challenge you to really think about what you're proposing to do. I think it's far more convoluted: it does not solve the keylogger problem and adds complexity to both the client and the server. If you think I'm wrong, then write it up in a spec and show us.

ajuc 8y ago
> If you think I'm wrong, then write it up in a spec and show us. Sure. It's fun. On password creation: 0.0. demand 25% longer passwords from users than considered safe 0.1. along with the hash of the whole password remember a randomly choosen 25% of the characters of the password and their positions (in clear text or reversibly encrypted) On each login: 1.0. ask only for the characters in positions you haven't remembered 1.1. server-side fill the positions you remembered 1.2. hash the result and see if it matches If hash matches: 2.0. randomly choose 1/3rd of the freshly provided positions and remember them in clear text on server replacing the previous ones 2.1. give access If hash doesn't match: 3.0. deny access, don't change anything on server If I understand correctly - to get the whole password keylogger must be specific to this bank site (to understand which characters are provided), and must be active on at least 4 logins. In my book that's a big improvement. And I can imagine writing the login page in a way that makes parsing it in keylogger to understand which characters are masked.
- dpark 8y ago
  If you only remember 25% of the characters, then you have to ask for 75% of the characters to generate the full hash. Asking for 75% of the characters defeats the purported reasons for partial password auth.

amingilani 8y ago

> What's more likely - that the bank gets hacked, or that you install a keylogger? The bank gets hacked. I say this with the utmost certainty because while I haven't been hacked since I started behaving securely at 15 years old, my bank that uses partial passwords was recently hacked. I live in Pakistan, a lot of banks were hacked 2018-2019. I also complained to them about saving passwords in plaintext. They never replied. Every bank in my country is terrible.

munchbunny 8y ago

Considering that password databases are getting leaked on a regular basis at this point, depending on any specific password database not getting leaked is a pretty bad bet.

marcosdumay 8y ago

My bank has been hacked (affecting my account) twice since I started using it, but I'm yet to see any effect of a successful attack against my machines...

cryptonector 8y ago

How many users get compromised if a bank gets compromised vs. if one user installs a keylogger?