3 ms·
Nice. Note, though, that accurately capturing the colors will let a bad guy brute-force the password one character at a time, which is trivial. Don't use this i
by JoachimSchipper 15y ago
Nice. Note, though, that accurately capturing the colors will let a bad guy brute-force the password one character at a time, which is trivial. Don't use this if you're worried about shoulder-surfers with cameras, or just plain don't use this with important passwords.
(Note that switching to a proper cryptographic hash does not stop the above attack.)
- skattyadz 15y agoAnd importantly, you can't rate limit client site JS like you can server-side with captchas etc.
- icebraining 15y agoNote, though, that accurately capturing the colors will let a bad guy brute-force the password one character at a time How so? Since this is generated from the hash, this attack doesn't reveal more than an hash does, and you certainly can't brute-force one char at a a time from an hash.
- CJefferson 15y agoAssuming I record the colours generated when each character is entered, then I have a hash of just the first character. Cracking that is trivial. Then I can go and crack the second character. There might be a tiny amount of fuzzyness if I can't exactly match the first character hash, but it would be fairly close. I suspect it would be fairly easy to write a computer program which even did this automatically, from a recorded video.
- rodh 15y agoPerhaps adding a short delay (under a second) after the last keystroke before refreshing the image would make this much more secure.
- budgi3 15y agoWould delaying showing the colors until focus is removed from the password input eliminate this vector?
- sc00ter 15y agoGives a whole new meaning to "rainbow tables". Ahem!
- skattyadz 15y agoWhy not just use a video camera to watch them type on the keyboard? Plus, mobile devices show the last character typed. You're right, but this could be avoided by (for example) only displaying colors after 4 characters are typed
- JoachimSchipper 15y agoThat reduces the problem to brute-forcing the first four characters...
- burgerbrain 15y agoI think a better solution would be to only show the colour hash after there hasn't been a keypress in a few seconds. This would likely be a pretty good way of making sure you only displayed the hash after they were done typing their password, which would prevent enabling a brute force attack.
- icebraining 15y agoOh, right, I only considered photos of the last pattern, not of all of them.
- deleted 15y ago[deleted]
- alextgordon 15y agoJust reduce the entropy. E.g. use 20 colors instead of 4 sextillion. That still helps the user a lot (a mistyped password has a large chance of having a different color). But it only reduces the number of passwords an attacker must try to 1/20th.
- JoachimSchipper 15y agoIt reduces it from ~64^password_length to ~3^password_length, and that assumes that the password is a random jumble of letters. If it's a long phrase, like "I know the entropy of English words isn't terribly high, but a lot of them make a better password than what people typically choose", the effect is even stronger.
- cynwoody 15y agoYou could delay the display of the color pattern until the user has stopped keying for a second or so. That way, the shoulder surfer would not get incremental versions to work from, unless the user types really s l o w l y.