5 ms·
Only if it doesn't only rely on a master password
by jgtrosh 3y ago
Only if it doesn't only rely on a master password
- apendleton 3y agoA nice thing about master passwords though is that since you don't have to type them in as often, they can be very long. 95% accuracy probably isn't good enough to reliably reproduce a sentence-length master password, at least if it's only captured once.
- belval 3y ago95% means that on average only 1 in 20 keystroke will be wrong. Even if your password is very long (40-60) that means only 2-3 errors. Since more people are not machines their long password will be a combination of words like the famous "horsestaplebatterycorrect" example from xkcd. Even if you flip a few letters from something like the above a human attacker will easily be able to fix it manually. "horswstaplevatterucorrect" for example is still intelligible.
- TheCleric 3y agoOn average 2-3 errors. However the real thing we want to look at is what is my chance of guessing right across ALL characters. For 1 it's 95%, for 2 it's 90.2%, and it gets worse from there. The formula for accuracy would be .95^c where c is the number of characters in the password. So the chance of getting EVERY key correct in a 40 character password is < 13% and < 5% for 60 characters.
- llbeansandrice 3y agoRight. The comment above is saying even if you are incorrect in 2-5 keystrokes it’s not hard to guess the correct keystrokes if you’re using a sentence style password. You don’t need to guess every character.
- whelp_24 3y agothat's pretty high when you can use a computer to run the guesses
- rightbyte 3y agoWhat if the password is typed twice? You can easely figure it out then.
- koolba 3y agoThe master password is also offline and require the key file to u lock the rest of the passwords. So by itself it’s not enough to compromise the accounts in the key file. The attacker would need the key file as well.
- SideQuark 3y ago95% accuracy means for each stroke, the most likely key is the top choice. Most models return a probability distribution per key, and it's very like the other keys are in the top 2 or 3. Then you simply have the password cracker start trying passwords ordered by probability, and I bet it breaks your sentence within very few tries.
- coldtea 3y ago>a sentence-length master password Ij on-tep of sentenca lentg, it's alio sentemce-bused ("corvect harse batterg stapfe") then ut would be quiti eady to guess even wits worse accurasy. (If on-top of sentence lenth, it's also sentence-based ("correct horse battery staple") then it would be quite easy to guess even with worse accuracy.)
- Gh0stRAT 3y agopotential solution: keep a few intentional typos in your passphrases. It also makes dictionary attacks much harder.
- GhostWhisperer 3y agonow you have to remember the the typos
- coldtea 3y agoPlus, if they can tell what the actual words would be, then brute forcing the typos is trivial
- Guvante 3y agoDoesn't everybody not require only a password? Offline you need the database which isn't public. Online you usually need something else on new machines to get at the true master password.
- lamontcg 3y agoDon't type your master password on zoom calls
- jeromegv 3y agoOr use your fingerprint
- worthless-trash 3y agowhy is that ?
- microtonal 3y ago1Password allows unlocking with a fingerprint (Touch ID) or Apple Watch, at least on a Mac. So you can unlock your password manager during a Zoom call, and nobody can snoop your master password. (With 1Password, the master password is not enough to do a remote account takeover, you also need the second-factor key. And you can't snoop it, since it is only required during the first login, so a user will never type it after that.)
- kristopolous 3y ago[insert yubikey plug] I don't use one but I know people who swear by them. Also this is an extremely obvious result. Typing is obviously a form of "penmanship", it was well known that telegraph operators could identify each other by how they tapped out Morse code in the 1800s. People have been able to do this based upon key stroke latency and even identify people based on habitual mouse patterns for decades. Audio recordings work as yet another reliable proxy? Shocked!! I am amazed that people can do such obvious things and get published, have articles written on them... I need to get in on that, sounds easy I can make a web demo. You turn on the microphone type a couple things into a box on the web browser. Then you go to a different window and continue typing and then the model predicts What you are typing. As long as it's proper grammar you can get to effectively 100% accuracy. It'll appear to be spooky magic. I just might take the time.
- mercer 3y agoYou sound confident enough that'd I'd like to see you show that off :P.
- kristopolous 3y agosounds like a good exercise although it'll literally just be for my own personal amusement. Nobody actually cares about this unless you've got some institutional clout which I do not. Praise for the PhD would be ridicule for you and me. But really, should be fun ... the laptop dock mic will be great for this. If it's external you're in trouble ... but the researchers just used the onboard so it'll be fine.
- tedunangst 3y agoWhat actually are you going to do if you spy on my zoom call and learn my master password is bigjarofpickles?
- Sai_ 3y agoHacker: tedunangst, what’s your email? Wanna invite you to that thing! Hacker: man, I hate typing passwords. Do you use password managers? Any reccos? … I am become hacker, destroyer of tedunangst’s bank account.
- microtonal 3y ago1Password requires an extra key upon the first login that you never have to type afterwards. So, have fun trying to log in to that password manager, even if you have the master password. Also, you can also use and require a hardware FIDO2 token as second factor.