3 ms·
How would you do that though? Because I can't think of an efficient way to do that that doesn't involve having the extension have access to the password. I me
by TheLoneWolfling 12y ago
How would you do that though?
Because I can't think of an efficient way to do that that doesn't involve having the extension have access to the password.
I mean, you could store the password hash + length, but then you're securely hashing every single overlapping substring of what you enter, which is not exactly fast. Especially as KDFs are designed to be slow.
And if you store the password hash then you enable an offline attack.
- brazzledazzle 12y agoIt wouldn't have to do it in real time right? It could easily batch typing sessions and have the server chew through them asynchronously.
- TheLoneWolfling 12y agoSo then you're sending every keystroke people make to a central server? Even assuming that the connection is secure (never a good assumption), that still means that there is a single point of failure. And one with drastic consequences.
- brazzledazzle 12y agoBut doesn't any service that you authenticate against assume the channel is secure? Presumably this would use SSL. I do agree about the single point of attack though. Perhaps you could do an asynchronous substring check locally when the CPU is idle.
- TheLoneWolfling 12y agoBut then anyone who can gain access to the computer once can then perform an offline attack on the password at their leisure.
- brazzledazzle 12y agoTrue, but anyone that can gain privileged access to the computer is already king of the castle. Why attack it offline when you can just keylog it? I think it goes back to being one part of an overall security posture. Encrypt your workstations and people can't just pick them up and own them.