4 ms·

Interesting. If say 3 passwords using that algorithm leaked, would it be possible to deduce the algorithm itself? Edit: what about digit-only password?

by pil0u 3y ago

Aerbil313 3y ago
No. Not without a proper examination by someone who knows historical cryptography techniques, those used before computers. I'd expect the only real threat to be an automated transformer AI solution actively looking for these types of algorithmic passwords, and one which already has access to a few of my passwords. Which is extremely unlikely given that no one uses algorithmic passwords. I was using a separate algorithm for more critical things, like my Google account but I deemed it unnecessary after some time because there is virtually no chance someone will crack it. Though I should admit I still didn't migrate all my passwords to the latest and safest specification of the algorithm. Only using digits limits the probabilities space drastically.
- pil0u 3y ago
  I won't come at you, for lack of time and expertise. I'm genuinely interested in that approach, but I'm probably too afraid to design an algorithm that would be vulnerable for reasons I couldn't imagine. For digit-only, I meant platforms that forces you that requirement - my bank does. What about MFA?
  - Aerbil313 3y ago
    Currently I use custom passwords which I write down in a single file for digit-only passwords. But while I was writing my top comment, an idea about converting letters in app/website name to digits and scrambling them came to me. Take a look for the algorithms: https://www.google.com/search?q=historical+cryptography+techniques https://www.google.com/search?q=historical+cryptography+tech... Choose one which you can run in your head, don't use it as-is, insert random chars at certain places, substitute some letters in the app name for others, make sure it looks like randomly generated, and you will be fine. I still use 2FA with Authenticator (on iPhone), fallback set as SMS. Only thing I need is my government issued ID to get a new SIM card if the current one burns.
    - pil0u 3y ago
      Thank you for the details and hints, much appreciated.
cooperadymas 3y ago
With a password manager, you only need to know 1 password to "deduce" all the others. So wouldn't a 3-password system be better anyway?
- toyg 3y ago
  The difference is that the one password for the manager is kept in a location very difficult to attack, whereas various services are inevitably prone to be pwned.
  - cooperadymas 3y ago
    Theoretically anyway. See LastPass. Still, the algorithm method requires 3 services to be breached. Those services must be storing the passwords in plaintext or an otherwise retrievable method. The bad actor must put together the fact that your account is the same across all 3 services. Then they must analyze your password and reverse engineer your algorithm. That seems a lot less likely than your master password getting nabbed. The attack vector for a PW manager is a lot easier. They're obvious targets for both breaches and social hacks. One person looking over your shoulder at the coffee shop is as or more likely than anything else. They can even swipe your phone in that scenario to beat MFA. I'm not advocating an algorithmic approach. The average person isn't going to understand this (heck, they don't understand PW managers either). And if they did, most algos would be something like ServiceName! anyway. On the whole a password manager is a better solution, but it's not without its own trade offs, which don't get nearly enough discussion.

Interesting. If say 3 passwords using that algorithm leaked, would it be possible to deduce the algorithm itself? Edit: what about digit-only password?

by pil0u 3y ago

Interesting. If say 3 passwords using that algorithm leaked, would it be possible to deduce the algorithm itself? Edit: what about digit-only password?

Aerbil313 3y ago

No. Not without a proper examination by someone who knows historical cryptography techniques, those used before computers. I'd expect the only real threat to be an automated transformer AI solution actively looking for these types of algorithmic passwords, and one which already has access to a few of my passwords. Which is extremely unlikely given that no one uses algorithmic passwords. I was using a separate algorithm for more critical things, like my Google account but I deemed it unnecessary after some time because there is virtually no chance someone will crack it. Though I should admit I still didn't migrate all my passwords to the latest and safest specification of the algorithm. Only using digits limits the probabilities space drastically.

pil0u 3y ago
I won't come at you, for lack of time and expertise. I'm genuinely interested in that approach, but I'm probably too afraid to design an algorithm that would be vulnerable for reasons I couldn't imagine. For digit-only, I meant platforms that forces you that requirement - my bank does. What about MFA?
- Aerbil313 3y ago
  Currently I use custom passwords which I write down in a single file for digit-only passwords. But while I was writing my top comment, an idea about converting letters in app/website name to digits and scrambling them came to me. Take a look for the algorithms: https://www.google.com/search?q=historical+cryptography+techniques https://www.google.com/search?q=historical+cryptography+tech... Choose one which you can run in your head, don't use it as-is, insert random chars at certain places, substitute some letters in the app name for others, make sure it looks like randomly generated, and you will be fine. I still use 2FA with Authenticator (on iPhone), fallback set as SMS. Only thing I need is my government issued ID to get a new SIM card if the current one burns.
  - pil0u 3y ago
    Thank you for the details and hints, much appreciated.

cooperadymas 3y ago

With a password manager, you only need to know 1 password to "deduce" all the others. So wouldn't a 3-password system be better anyway?

toyg 3y ago
The difference is that the one password for the manager is kept in a location very difficult to attack, whereas various services are inevitably prone to be pwned.
- cooperadymas 3y ago
  Theoretically anyway. See LastPass. Still, the algorithm method requires 3 services to be breached. Those services must be storing the passwords in plaintext or an otherwise retrievable method. The bad actor must put together the fact that your account is the same across all 3 services. Then they must analyze your password and reverse engineer your algorithm. That seems a lot less likely than your master password getting nabbed. The attack vector for a PW manager is a lot easier. They're obvious targets for both breaches and social hacks. One person looking over your shoulder at the coffee shop is as or more likely than anything else. They can even swipe your phone in that scenario to beat MFA. I'm not advocating an algorithmic approach. The average person isn't going to understand this (heck, they don't understand PW managers either). And if they did, most algos would be something like ServiceName! anyway. On the whole a password manager is a better solution, but it's not without its own trade offs, which don't get nearly enough discussion.