4 ms·

I guess more reason to just use a password manager to autofill your password?

by yowzadave 3y ago

kypro 3y ago
Or just use 2fa
- bee_rider 3y ago
  If you have 2FA and one part of it is easily figured out, then you have one factor authentication. If you cared enough about the authentication in the first place to bother with 2FA, then I guess it seems like the reduction there is still something to be worried about, right? Lots of “two factor authentication” schemes seem to involve just getting a text or something, so, not very secure at all. Of course, this is bad 2FA, but it is popular.
  - gleenn 3y ago
    Perfect is the enemy of good. Text based 2FA is compromisable relatively easily but at least it's an extra hurdle.
    - 3np 3y ago
      It's the "or just" being the issue there, not the "use 2fa".
  - GhostWhisperer 3y ago
    which is the point of 2fa – when the 1st factor fails the 2nd holds
- barrotes 3y ago
  Now that I know about the existence of this generation of acoustic attacks I would like to have the possibility to insert a second "master password" different from the main one, that instead of letting me directly access to my passwords just allows me to use fingerprint to get them. Guess if it's already possible
jgtrosh 3y ago
Only if it doesn't only rely on a master password
- apendleton 3y ago
  A nice thing about master passwords though is that since you don't have to type them in as often, they can be very long. 95% accuracy probably isn't good enough to reliably reproduce a sentence-length master password, at least if it's only captured once.
  - belval 3y ago
    95% means that on average only 1 in 20 keystroke will be wrong. Even if your password is very long (40-60) that means only 2-3 errors. Since more people are not machines their long password will be a combination of words like the famous "horsestaplebatterycorrect" example from xkcd. Even if you flip a few letters from something like the above a human attacker will easily be able to fix it manually. "horswstaplevatterucorrect" for example is still intelligible.
    - TheCleric 3y ago
      On average 2-3 errors. However the real thing we want to look at is what is my chance of guessing right across ALL characters. For 1 it's 95%, for 2 it's 90.2%, and it gets worse from there. The formula for accuracy would be .95^c where c is the number of characters in the password. So the chance of getting EVERY key correct in a 40 character password is < 13% and < 5% for 60 characters.
      - llbeansandrice 3y ago
        Right. The comment above is saying even if you are incorrect in 2-5 keystrokes it’s not hard to guess the correct keystrokes if you’re using a sentence style password. You don’t need to guess every character.
      - whelp_24 3y ago

I guess more reason to just use a password manager to autofill your password?

kypro 3y ago

Or just use 2fa

bee_rider 3y ago
If you have 2FA and one part of it is easily figured out, then you have one factor authentication. If you cared enough about the authentication in the first place to bother with 2FA, then I guess it seems like the reduction there is still something to be worried about, right? Lots of “two factor authentication” schemes seem to involve just getting a text or something, so, not very secure at all. Of course, this is bad 2FA, but it is popular.
- gleenn 3y ago
  Perfect is the enemy of good. Text based 2FA is compromisable relatively easily but at least it's an extra hurdle.
  - 3np 3y ago
    It's the "or just" being the issue there, not the "use 2fa".
- GhostWhisperer 3y ago
  which is the point of 2fa – when the 1st factor fails the 2nd holds
barrotes 3y ago
Now that I know about the existence of this generation of acoustic attacks I would like to have the possibility to insert a second "master password" different from the main one, that instead of letting me directly access to my passwords just allows me to use fingerprint to get them. Guess if it's already possible

jgtrosh 3y ago

Only if it doesn't only rely on a master password

apendleton 3y ago
A nice thing about master passwords though is that since you don't have to type them in as often, they can be very long. 95% accuracy probably isn't good enough to reliably reproduce a sentence-length master password, at least if it's only captured once.
- belval 3y ago
  95% means that on average only 1 in 20 keystroke will be wrong. Even if your password is very long (40-60) that means only 2-3 errors. Since more people are not machines their long password will be a combination of words like the famous "horsestaplebatterycorrect" example from xkcd. Even if you flip a few letters from something like the above a human attacker will easily be able to fix it manually. "horswstaplevatterucorrect" for example is still intelligible.
  - TheCleric 3y ago
    On average 2-3 errors. However the real thing we want to look at is what is my chance of guessing right across ALL characters. For 1 it's 95%, for 2 it's 90.2%, and it gets worse from there. The formula for accuracy would be .95^c where c is the number of characters in the password. So the chance of getting EVERY key correct in a 40 character password is < 13% and < 5% for 60 characters.
    - llbeansandrice 3y ago
      Right. The comment above is saying even if you are incorrect in 2-5 keystrokes it’s not hard to guess the correct keystrokes if you’re using a sentence style password. You don’t need to guess every character.
    - whelp_24 3y ago