3 ms·

Maybe we should store our credentials on fully publicly accessible network using an enormous key. This way, at least there is no surprise when a breach occurs a

Maybe we should store our credentials on fully publicly accessible network using an enormous key. This way, at least there is no surprise when a breach occurs and it isn't necessary to trust dummies like LastPass to have good practices - only trust yourself and the quality of your key. The good guys can let people know if their key sucks and there might be some auditing of the bad guys. Eventually the bad guys will stop bothering since they won't be able to crack anything (with current technology).

wkat4242 3y ago
What I do is use zx2c4 pass ( https://www.passwordstore.org/ https://www.passwordstore.org/ ) where every password is encrypted by several gpg public keys, of which the secret ones are stored on several Yubikeys in openpgp mode. This way there is no "master password". You need one of the keys and its PIN even if you have the encrypted passwords. Anyone with access to the encrypted files would need to brute force a truly random RSA2048 key which is NSA territory (and elliptic key can also be used now). Or steal one of the yubis and crack the hardware because the PIN is limited to 3 attempts just like on a bank card. Or attack the endpoint which is feasible with any password manager, in fact mine has extra protection because the yubis require a touch for every decode. Clients are available on desktops (CLI and with GUI) and Android. iOS is sadly not possible because you need more access to the NFC chip to talk to OpenPGP smartcards than Apple allows. They only allow fido2 and basic tags. I wonder if this could be done with fido2 hardware backing but for now it's not possible. This attack in the article uses the fact that the encryption key is directly derived from the master password using a key derivation algorithm. I'm surprised there is no commercial password vault that uses hardware-backed security like I do because it doesn't have this vulnerability which is clearly an issue in the real world. With hardware backing there is no delicate balance between usability (waiting for the master password to go through the key derivation) and security (a feasible brute force attack) because these two items aren't directly related. This kind of breach shouldn't have happened.
- osigurdson 3y ago
  >> Anyone with access to the encrypted files would need to brute force a truly random RSA2048 key which is NSA territory (and elliptic key can also be used now). I'm thinking the canonical example of an open network is Bitcoin. Here, everyone knows the public key and could potentially crack the private key from it (for enormous gain obviously). Just do the same thing with a sufficiently large AES key for example.
  - lxgr 3y ago
    Where’d you store that key securely, though? It’s passwords all the way down (unless you use smartcards or tokens).
    - osigurdson 3y ago
      I think if I had one key as the root to all others (just like LastPass basically), it could be manageable.
      - lxgr 3y ago
        Practically, how would you do it? Memorable passwords unfortunately have really low entropy.
deleted 3y ago
[deleted]
lxgr 3y ago
Today’s acceptable key is tomorrows weak key. Access controls to the vault do place a high burden on the service operator, but without it, I believe users with semi-weak passwords would get picked off left and right.
- osigurdson 3y ago
  You would have to disallow weak passwords. It should be at least as cryptographically hard to crack as (the also fully public) Bitcoin network. Also, turn the bad guys into good ones by offering a reward for any cracked credentials (if the credentials are not used within a particular period of time). Seed the system with fake credentials that can be used by authorities to track down criminals (if used of course). Essentially, build a game with the right incentives.
  - lxgr 3y ago
    > You would have to disallow weak passwords. That's unfortunately very hard: Determining what constitutes a weak password is computationally more expensive than actually attacking a database dump of many weak password hashes. > turn the bad guys into good ones by offering a reward for any cracked credentials What bad guy would take your reward if it's lower than the value at risk? And if the reward is higher – how would you fund that? > Seed the system with fake credentials that can be used by authorities to track down criminals How? This might work for online account takeovers, but not for the problem discussed in the article, i.e. compromised crypto wallets. Hash cracking doesn't leave a fingerprint.

wkat4242 3y ago

What I do is use zx2c4 pass ( https://www.passwordstore.org/ https://www.passwordstore.org/ ) where every password is encrypted by several gpg public keys, of which the secret ones are stored on several Yubikeys in openpgp mode. This way there is no "master password". You need one of the keys and its PIN even if you have the encrypted passwords. Anyone with access to the encrypted files would need to brute force a truly random RSA2048 key which is NSA territory (and elliptic key can also be used now). Or steal one of the yubis and crack the hardware because the PIN is limited to 3 attempts just like on a bank card. Or attack the endpoint which is feasible with any password manager, in fact mine has extra protection because the yubis require a touch for every decode. Clients are available on desktops (CLI and with GUI) and Android. iOS is sadly not possible because you need more access to the NFC chip to talk to OpenPGP smartcards than Apple allows. They only allow fido2 and basic tags. I wonder if this could be done with fido2 hardware backing but for now it's not possible. This attack in the article uses the fact that the encryption key is directly derived from the master password using a key derivation algorithm. I'm surprised there is no commercial password vault that uses hardware-backed security like I do because it doesn't have this vulnerability which is clearly an issue in the real world. With hardware backing there is no delicate balance between usability (waiting for the master password to go through the key derivation) and security (a feasible brute force attack) because these two items aren't directly related. This kind of breach shouldn't have happened.

osigurdson 3y ago
>> Anyone with access to the encrypted files would need to brute force a truly random RSA2048 key which is NSA territory (and elliptic key can also be used now). I'm thinking the canonical example of an open network is Bitcoin. Here, everyone knows the public key and could potentially crack the private key from it (for enormous gain obviously). Just do the same thing with a sufficiently large AES key for example.
- lxgr 3y ago
  Where’d you store that key securely, though? It’s passwords all the way down (unless you use smartcards or tokens).
  - osigurdson 3y ago
    I think if I had one key as the root to all others (just like LastPass basically), it could be manageable.
    - lxgr 3y ago
      Practically, how would you do it? Memorable passwords unfortunately have really low entropy.

deleted 3y ago

[deleted]

lxgr 3y ago

Today’s acceptable key is tomorrows weak key. Access controls to the vault do place a high burden on the service operator, but without it, I believe users with semi-weak passwords would get picked off left and right.

osigurdson 3y ago
You would have to disallow weak passwords. It should be at least as cryptographically hard to crack as (the also fully public) Bitcoin network. Also, turn the bad guys into good ones by offering a reward for any cracked credentials (if the credentials are not used within a particular period of time). Seed the system with fake credentials that can be used by authorities to track down criminals (if used of course). Essentially, build a game with the right incentives.
- lxgr 3y ago
  > You would have to disallow weak passwords. That's unfortunately very hard: Determining what constitutes a weak password is computationally more expensive than actually attacking a database dump of many weak password hashes. > turn the bad guys into good ones by offering a reward for any cracked credentials What bad guy would take your reward if it's lower than the value at risk? And if the reward is higher – how would you fund that? > Seed the system with fake credentials that can be used by authorities to track down criminals How? This might work for online account takeovers, but not for the problem discussed in the article, i.e. compromised crypto wallets. Hash cracking doesn't leave a fingerprint.