4 ms·
If you only remember 25% of the characters, then you have to ask for 75% of the characters to generate the full hash. Asking for 75% of the characters defeats
by dpark 8y ago
If you only remember 25% of the characters, then you have to ask for 75% of the characters to generate the full hash. Asking for 75% of the characters defeats the purported reasons for partial password auth.
- ajuc 8y agoWhy? Now all the universal keyloggers don't work (because they remember which keys were pressed, but not which positions they refer to).
- munk-a 8y agoI mean... for keyloggers and easier approach is just to distribute some sort of possession authentication device (like a dongle or codes via SMS) where a replayed password will fail to work or... insist that passwords meet some crazy entropy requirements (like 48 characters) and provide download links to password managers that can assist in generating/storing these along with some rudimentary education efforts on the site.
- ajuc 8y agoSms codes are used anyway, to authorize transfers and changes in the account.
- ljm 8y agoKeyloggers don't wrap themselves up after the first log in. They could easily take the data from several log-ins (if they can't scan the HTML) and eventually get a complete password. Besides which, the partial login isn't random either. It's always sequential. You'll never be asked to enter character 3, then 1, then 8. It will always be asked in the same order as the password string itself.
- ajuc 8y ago> It's always sequential. It's monotonic, but not sequential. On one login you will be asked for positions 1,3,4,7,9, 10, on another you will be asked for letters 1,2,5,6,7,8. Merging such partial information isn't trivial if you don't know which positions you got. Let's say you have 16-letter password. That's 4 missing letters during each login. There's (16 over 4) = 1820 possible ways that the characters the keylogger see can be positioned in the real password.
- inetknght 8y agoWhen computers can generate billions of hashes per second, what makes you think a mere 1820 possible considerations are significant?
- dpark 8y agoYou get 75% of the letters every time, in order. It's pretty trivial to merge these together after a few examples. Every time you ask for a set of characters, the set of possible outcomes shrinks, and 1820 isn't exactly a large set of possibilities to start with (for your 16-character example). Given that most people do not use random passwords (and are even less likely to in with a scheme like this), guessing the missing characters is likely trivial for most passwords. Also the scheme you're describing is very clearly not the one in use here given that they asked for only 4 characters.