3 ms·

Okay, let's get the first part out of the way really quickly: this would be an amazing piece of technology, if it were to be implemented successfully. Having a

Okay, let's get the first part out of the way really quickly: this would be an amazing piece of technology, if it were to be implemented successfully. Having a password that even you don't consciously know would be a huge leap in security, and would presumably make password guessing all but impossible--after all, if you don't need to remember your password in the traditional sense, it could be significantly more complex than traditional "Pa55w0rd1!"-style passphrases. I, personally, don't know enough about the science behind this to comment on its feasibility. I do, however, know a lot about security in general. Every time there is a leap in "password technology," meaning public key authentication, or password-keepers, or xkcd's "let's use several words instead of random characters," people seem to think that it would protect all their online assets. That if the password is secure, so is their data that's stored somewhere on the Internet. On one hand, yes, this technology would easily protect you from brute-force and dictionary-based attacks. After all, if there's no dictionary (because no words are used in the secret "pattern,"), how could a dictionary be used to attack the protected account? What isn't factored into this example is the service you're protecting itself. If you look at high profile breaches over the last year, you'll notice that few, if any of them are straightforward password-guess breaches. Sure, some (like the Wired journalist) could have been prevented with strong and unique passphrases. Most of the attacks could not. If there is, for example, a buffer overflow in a service that is listening on the Internet, remote code execution may be possible. If you can execute arbitrary code on a remote service, you are able to effectively take over that machine. Combine this with privilege escalation, and it's pretty much game over for most data stored there. Proper database security like unique salts per user account can minimize the damage, but the fact is that the compromise still happened and the data--like your personal photos, or documents uploaded to cloud storage--are probably in the hands of an attacker. It's always great to see cutting edge research in any field related to computer security, but don't think that "passwords even you don't know!" are going to protect anything behind them. Passwords are just the front door to the mansion, and there's a whole lot of other ways to break in. The short version is that there will always be a difference between account security and application security.

mertd 14y ago
What about the other end of the spectrum, by which I mean mean low profile breaches affecting one person, caused by -for example- a jealous ex. Are the compounded losses due to these considered too minor in comparison to high profile breaches?
B-Con 14y ago
> On one hand, yes, this technology would easily protect you from brute-force and dictionary-based attacks. I highly doubt that. There will be a finite number of possible patterns. So brute force will be possible. There will likely be some types of patterns or some pattern components that do not follow an even distribution, so dictionary attacks will still exist. (Really, a dictionary attack is simply a brute force attack that takes advantage of the non-uniform choices of passwords.) My guess is that such games would be chosen based on techniques that produce the best (aka, most uniform) distributions of responses from users, but I doubt that it will be perfect. A brute-force attacker would probably be able to do noticeably better than blind brute-force.

mertd 14y ago

What about the other end of the spectrum, by which I mean mean low profile breaches affecting one person, caused by -for example- a jealous ex. Are the compounded losses due to these considered too minor in comparison to high profile breaches?

B-Con 14y ago

> On one hand, yes, this technology would easily protect you from brute-force and dictionary-based attacks. I highly doubt that. There will be a finite number of possible patterns. So brute force will be possible. There will likely be some types of patterns or some pattern components that do not follow an even distribution, so dictionary attacks will still exist. (Really, a dictionary attack is simply a brute force attack that takes advantage of the non-uniform choices of passwords.) My guess is that such games would be chosen based on techniques that produce the best (aka, most uniform) distributions of responses from users, but I doubt that it will be perfect. A brute-force attacker would probably be able to do noticeably better than blind brute-force.