9 ms·

This is a substitution cipher and it's not very secure. Consider what we can do if we compromise the Amazon password that's given as an example on the website:

by agwa 12y ago

This is a substitution cipher and it's not very secure. Consider what we can do if we compromise the Amazon password that's given as an example on the website: sh(/J3HqAfQsu..u.rqf Since the password came from Amazon, we know that the last 6 characters are "Amazon," which tells us that: . = A u = M r = Z q = O f = N Now we can start attacking the codeword, which are the characters between the 8-character "space bar code" and the website name: AfQsu. Using the letters we already know, we can determine that the codeword is: _N__MA It's probably a dictionary word, and we know that the blank spaces don't correspond to any of the letters we already know. According to the following command: grep '^[^amzon]n[^amzon][^amzon]ma$' < /usr/share/dict/american-english ...the only possible codeword is "engima," so now we know that: A = E Q = G s = I Combine with another compromised password, and we're coming dangerously close to being able to generate a password for any arbitrary website. Edit: I agree with the replies that this is an unlikely attack considering how passwords are typically compromised. And it's probably better than how most people choose passwords. But the website claims that this generates "very strong passwords," which is nonsense.

advisedwang 12y ago
There is no need to even break the codeword as it is the same for every site. In the above example say we want to guess their gmail password, it is probably: sh(/J3HqAfQsu.?u.?? We have only three characters to guess! OTOH this is only relevant for targeted attacks where the attacker has one password. This still protects you pretty well from bulk attacks (so long as the card is not widely used) and is miles better than re-used or poor passwords at little usability cost.
- agwa 12y ago
  With the codeword broken, we can narrow the gmail password down to a single unknown character! sh(/J3HqAfQsu.Qu.s?
- johnnymonster 12y ago
  The site is only an example. You would actually order your own unique card to carry with you. No one would be able to guess your password since your spacebar code is unique to your card.
  - lvh 12y ago
    That doesn't change the GP's point. One compromise means that password and spacebar code is compromised for all passwords. Other comments have already addressed how wimpy a substitution cipher is. Add to that that you can't reasonably cycle keys here, and you have yourself one pretty terrible password system.
  - bigbugbag 12y ago
    This is wishful thinking, factor in the actual organization doing global surveillance and spying, say NSA who is known to intercept hardware to flash firmware with backdoors and suddenly the need to guess is no more, your card can be legally copied at any point between production or transportation to you.
    - gambiting 12y ago
      Oh my god, if you really worry about NSA hacking your accounts, then probably this card is not for you. And they probably don't need to guess your passwords, they can just get in with a court order. This is for people who are still using passwords like "password12345" because ".;l[ppop[o#@!" is too hard to remember.
jameshart 12y ago
It's vulnerable to a known ciphertext attack, yes. But the assumption of password usage is that the password itself is never stored - the ciphertext of this cipher should itself not be available to an attacker. An attacker looking to bruteforce a compromised file of passwords is going to struggle to figure out that your password is sh(/J3HqAfQsu..u.rqf. Even if they do find it, what would tip them off that it was generated by a substitution cipher, rather than a random password generator like LastPass? The fact it ends in a letter sequence that follows the repetition pattern of AMAZON? I think that's quite a stretch.
- adestefan 12y ago
  > But the assumption of password usage is that the password itself is never stored... That's a bold assumption.
- techrat 12y ago
  >But the assumption of password usage is that the password itself is never stored - the ciphertext of this cipher should itself not be available to an attacker. I think the Gawker leak alone is enough of a precedent to ensure that this can never be assumed.
- nsgi 12y ago
  An attacker might setup a malicious site to collect passwords. They could also modify the server to record passwords when the user logs in.
  - sago 12y ago
    You also have to totally trust the company making the cards. Who'll also know your email address and name. Maybe this particular company is legit, but seems like an obvious scam to set up something like this and have your victims basically set their passwords to what you tell them to.
- pmontra 12y ago
  With such degree of character's reuse you must trust the attackers are not the admins of a site where you use those password, because they can look at the cleartext entered on the keyboard. Obviously this is still an improvement over using the same password123 for every single site but those nasty admins could easily check if a password ends with characters matching their domain. Then all the schema falls apart.
erglkjahlkh 12y ago
In other words, this card is cryptographically nonsense. On the other hand, nearly every attack against passwords is non-targeted, software trolling for matches with word lists and such. A user of qwertycard is paradoxically safe, especially as single password (from for instance hacked database) does not contain telltales of being generated by substitution cipher. In order to be in danger someone would have to either do some mathematical analysis, someone should have already tools looking for substitution ciphers, or someone should set up some application (scripts, whatever) to look for substition ciphers and break them. Now the crucial part: No one bothers. Typically almost 9/10 of the targets use the same "catdog123" password on every site. They will be used because it is less work. Unless you are in a risk of targeted attacks, these cards actually can improve your overall security, even despite the flaw in logic. (Which could be mitigated by the way, there are several ways to that.) In other words, non-geeks can benefit from this. My mom could.
hyperbovine 12y ago
This sort of objection is raised whenever basically any mechanism for remembering strong passwords is presented. Much like many results in computational complexity, worst-case results are not necessarily indicative of real-world utility. To wit, in the scenario you outlined the attacker must a) know beforehand that the target was using this device; b) know beforehand that the inserted middle portion was vulnerable to a dictionary attack; c) have compromised at least one and more likely several websites; and d) obtained the cleartext password from each of said websites. This seems an almost comically unrealistic chain of events for the average case. Yes, a determined and sophisticated attacker could probably pull this off, but if you have enemies who are willing to go to such lengths you probably are aware of it and would not be using a silly little crutch in the first place. For the rest of us, this seems like a potentially useful alternative to using 'c@td0g11!' for everything.
- gravedave 12y ago
  The rest of us could also make up our own password generating techniques as well, and have c@td0g11!el8oo8, c@td0g11!no5@m@ etc. el8oo8 is google backwards - but coming up with a word scrambling technique isn't hard, as many conspiracy theorists ought to know better. This wouldn't provide cipher encoding, but someone already mentioned https://www.passwordcard.org/ https://www.passwordcard.org/, and as you said, this is for the rest of us.
- deleted 12y ago
  [deleted]
- curun1r 12y ago
  > This sort of objection is raised whenever basically any mechanism for remembering strong passwords is presented. Yes, because we've basically realized that memorizing passwords isn't a workable solution. We should be recommending password managers that generate/store strong passwords and MFA for any account that needs to be secure. That these password generators themselves can now be unlocked using both memorized information and biometrics (TouchID and such) makes them all the more secure. Moreover, this is the only solution that's capable of dealing with all the asinine password requirements that get imposed on users...solutions like this card fail hard when the password requirements prohibit certain characters and/or other characteristics of these passwords (repeated characters, length, etc.) Until the world gets together and standardizes what constitutes a secure password, memorized passwords will always be a flawed solution.
RadioactiveMan 12y ago
What is the point of decoding this back into the user's original "ENIGMA" and "AMAZON" strings? In this case, "sh(/J3HqAfQsu..u.rqf" is the user's password. If you have that, there is nothing to crack. Edit: I see "Combine with another compromised password, and we're coming dangerously close to being able to generate a password for any arbitrary website.", which means that if an attacker could obtain a couple of these passwords, they could determine (a lot of) your qwertycard and gain access to more of your accounts. However, by the time an attacker has any of your passwords, I'm not sure that reverse engineering your qwertycard is an issue. As others put better than I, this would also mean that in addition to obtaining one or more plaintext passwords, the attacker would have to be targeting you specifically and know how you generated the passwords.
- ivanhoe 12y ago
  Not necessarily, if this card ever gets popular enough that it's worth the trouble in a first place, cracker can simply presume that at least some of the leaked passwords are created with it. He can then just go though the passwords one by one, decipher the last segment (this can be done very quickly), substitute it with the encrypted email domain (the email is also in the leaked DB) and check if the login works. If vulnerable passwords are in the DB they will all be found, and fairly fast, too. Once the cracker gets access to you email account all your bases are belong to him, he can then get even into the sites where you didn't use the password card at all, simply by using the forgotten pass link.
- hrjet 12y ago
  > If you have that, there is nothing to crack. Alice is a system administrator of xyz.com. She has access to the password that Bob uses on xyz.com. By reverse engineering Bob's password on xyz.com, Alice can then attack Bob's account on pqr.com.
  - dippyskoodlez 12y ago
    Unless you use pqr<space>, or cut space in half. Then that entire design goes out the window.
deleted 12y ago
[deleted]
Osmium 12y ago
SuperGenPass[1] seems to be a much better alternative to this, since it actually hashes your codeword with the website domain. Though it too has its issues (uses fast hash functions, running it as a bookmarklet is problematic too–better to run it offline). Still, completely agree with this: > I agree with the replies that this is an unlikely attack considering how passwords are typically compromised It's always going to be a trade-off. Ultimately any scheme that gets people to use better passwords, even if flawed, must still be an improvement over the alternative of post-it notes and birthdays... there's no such thing as perfect security, as we keep being told. [1] www.supergenpass.com
spinlock 12y ago
Aren't the cards all different? I assumed it would be a one-time-pad which is much more secure than a simple substitution.
- aquark 12y ago
  Yes, they are different. But that just makes it a substitution cipher with unique keys. A one time pad requires a key as long as all the messages you want to encode since each key bit is only used once.
wahsd 12y ago
You are making a rather critical mistake; you are not realizing that not only are the character associations variable, but so is the "space bar code", which will be unique for each card. The point being that, although not impossible, it is far more complicated to break the code than you describe here. You are also assuming that everyone will use the full name of the site, e.g., AMAZON, and not simply AZ or AMZN or AMA. For example, I may use YC or YCOMB or YCOMBINATOR for this site, which would also increase the combination exponent..
- agwa 12y ago
  > You are making a rather critical mistake; you are not realizing that not only are the character associations variable, but so is the "space bar code", which will be unique for each card. I don't know what you mean by "variable" "character associations," but note that my analysis doesn't depend on the space bar code at all, except assuming that it's the first eight characters, which the site's FAQ guarantees. Otherwise my analysis completely ignores it. > You are also assuming that everyone will use the full name of the site, e.g., AMAZON, and not simply AZ or AMZN or AMA. For example, I may use YC or YCOMB or YCOMBINATOR for this site, which would also increase the combination exponent.. True, but there are only a handful of logical choices for any given site. In any case, this is just haggling - the point is that attacks like this shouldn't be possible at all for something claiming to generate "very strong passwords."
deleted 12y ago
[deleted]

by agwa 12y ago

advisedwang 12y ago

There is no need to even break the codeword as it is the same for every site. In the above example say we want to guess their gmail password, it is probably: sh(/J3HqAfQsu.?u.?? We have only three characters to guess! OTOH this is only relevant for targeted attacks where the attacker has one password. This still protects you pretty well from bulk attacks (so long as the card is not widely used) and is miles better than re-used or poor passwords at little usability cost.

agwa 12y ago
With the codeword broken, we can narrow the gmail password down to a single unknown character! sh(/J3HqAfQsu.Qu.s?
johnnymonster 12y ago
The site is only an example. You would actually order your own unique card to carry with you. No one would be able to guess your password since your spacebar code is unique to your card.
- lvh 12y ago
  That doesn't change the GP's point. One compromise means that password and spacebar code is compromised for all passwords. Other comments have already addressed how wimpy a substitution cipher is. Add to that that you can't reasonably cycle keys here, and you have yourself one pretty terrible password system.
- bigbugbag 12y ago
  This is wishful thinking, factor in the actual organization doing global surveillance and spying, say NSA who is known to intercept hardware to flash firmware with backdoors and suddenly the need to guess is no more, your card can be legally copied at any point between production or transportation to you.
  - gambiting 12y ago
    Oh my god, if you really worry about NSA hacking your accounts, then probably this card is not for you. And they probably don't need to guess your passwords, they can just get in with a court order. This is for people who are still using passwords like "password12345" because ".;l[ppop[o#@!" is too hard to remember.

jameshart 12y ago

It's vulnerable to a known ciphertext attack, yes. But the assumption of password usage is that the password itself is never stored - the ciphertext of this cipher should itself not be available to an attacker. An attacker looking to bruteforce a compromised file of passwords is going to struggle to figure out that your password is sh(/J3HqAfQsu..u.rqf. Even if they do find it, what would tip them off that it was generated by a substitution cipher, rather than a random password generator like LastPass? The fact it ends in a letter sequence that follows the repetition pattern of AMAZON? I think that's quite a stretch.

adestefan 12y ago
> But the assumption of password usage is that the password itself is never stored... That's a bold assumption.
techrat 12y ago
>But the assumption of password usage is that the password itself is never stored - the ciphertext of this cipher should itself not be available to an attacker. I think the Gawker leak alone is enough of a precedent to ensure that this can never be assumed.
nsgi 12y ago
An attacker might setup a malicious site to collect passwords. They could also modify the server to record passwords when the user logs in.
- sago 12y ago
  You also have to totally trust the company making the cards. Who'll also know your email address and name. Maybe this particular company is legit, but seems like an obvious scam to set up something like this and have your victims basically set their passwords to what you tell them to.
pmontra 12y ago
With such degree of character's reuse you must trust the attackers are not the admins of a site where you use those password, because they can look at the cleartext entered on the keyboard. Obviously this is still an improvement over using the same password123 for every single site but those nasty admins could easily check if a password ends with characters matching their domain. Then all the schema falls apart.

erglkjahlkh 12y ago

In other words, this card is cryptographically nonsense. On the other hand, nearly every attack against passwords is non-targeted, software trolling for matches with word lists and such. A user of qwertycard is paradoxically safe, especially as single password (from for instance hacked database) does not contain telltales of being generated by substitution cipher. In order to be in danger someone would have to either do some mathematical analysis, someone should have already tools looking for substitution ciphers, or someone should set up some application (scripts, whatever) to look for substition ciphers and break them. Now the crucial part: No one bothers. Typically almost 9/10 of the targets use the same "catdog123" password on every site. They will be used because it is less work. Unless you are in a risk of targeted attacks, these cards actually can improve your overall security, even despite the flaw in logic. (Which could be mitigated by the way, there are several ways to that.) In other words, non-geeks can benefit from this. My mom could.

hyperbovine 12y ago

This sort of objection is raised whenever basically any mechanism for remembering strong passwords is presented. Much like many results in computational complexity, worst-case results are not necessarily indicative of real-world utility. To wit, in the scenario you outlined the attacker must a) know beforehand that the target was using this device; b) know beforehand that the inserted middle portion was vulnerable to a dictionary attack; c) have compromised at least one and more likely several websites; and d) obtained the cleartext password from each of said websites. This seems an almost comically unrealistic chain of events for the average case. Yes, a determined and sophisticated attacker could probably pull this off, but if you have enemies who are willing to go to such lengths you probably are aware of it and would not be using a silly little crutch in the first place. For the rest of us, this seems like a potentially useful alternative to using 'c@td0g11!' for everything.

gravedave 12y ago
The rest of us could also make up our own password generating techniques as well, and have c@td0g11!el8oo8, c@td0g11!no5@m@ etc. el8oo8 is google backwards - but coming up with a word scrambling technique isn't hard, as many conspiracy theorists ought to know better. This wouldn't provide cipher encoding, but someone already mentioned https://www.passwordcard.org/ https://www.passwordcard.org/, and as you said, this is for the rest of us.
deleted 12y ago
[deleted]
curun1r 12y ago
> This sort of objection is raised whenever basically any mechanism for remembering strong passwords is presented. Yes, because we've basically realized that memorizing passwords isn't a workable solution. We should be recommending password managers that generate/store strong passwords and MFA for any account that needs to be secure. That these password generators themselves can now be unlocked using both memorized information and biometrics (TouchID and such) makes them all the more secure. Moreover, this is the only solution that's capable of dealing with all the asinine password requirements that get imposed on users...solutions like this card fail hard when the password requirements prohibit certain characters and/or other characteristics of these passwords (repeated characters, length, etc.) Until the world gets together and standardizes what constitutes a secure password, memorized passwords will always be a flawed solution.

RadioactiveMan 12y ago

What is the point of decoding this back into the user's original "ENIGMA" and "AMAZON" strings? In this case, "sh(/J3HqAfQsu..u.rqf" is the user's password. If you have that, there is nothing to crack. Edit: I see "Combine with another compromised password, and we're coming dangerously close to being able to generate a password for any arbitrary website.", which means that if an attacker could obtain a couple of these passwords, they could determine (a lot of) your qwertycard and gain access to more of your accounts. However, by the time an attacker has any of your passwords, I'm not sure that reverse engineering your qwertycard is an issue. As others put better than I, this would also mean that in addition to obtaining one or more plaintext passwords, the attacker would have to be targeting you specifically and know how you generated the passwords.

ivanhoe 12y ago
Not necessarily, if this card ever gets popular enough that it's worth the trouble in a first place, cracker can simply presume that at least some of the leaked passwords are created with it. He can then just go though the passwords one by one, decipher the last segment (this can be done very quickly), substitute it with the encrypted email domain (the email is also in the leaked DB) and check if the login works. If vulnerable passwords are in the DB they will all be found, and fairly fast, too. Once the cracker gets access to you email account all your bases are belong to him, he can then get even into the sites where you didn't use the password card at all, simply by using the forgotten pass link.
hrjet 12y ago
> If you have that, there is nothing to crack. Alice is a system administrator of xyz.com. She has access to the password that Bob uses on xyz.com. By reverse engineering Bob's password on xyz.com, Alice can then attack Bob's account on pqr.com.
- dippyskoodlez 12y ago
  Unless you use pqr<space>, or cut space in half. Then that entire design goes out the window.

deleted 12y ago

[deleted]

Osmium 12y ago

SuperGenPass[1] seems to be a much better alternative to this, since it actually hashes your codeword with the website domain. Though it too has its issues (uses fast hash functions, running it as a bookmarklet is problematic too–better to run it offline). Still, completely agree with this: > I agree with the replies that this is an unlikely attack considering how passwords are typically compromised It's always going to be a trade-off. Ultimately any scheme that gets people to use better passwords, even if flawed, must still be an improvement over the alternative of post-it notes and birthdays... there's no such thing as perfect security, as we keep being told. [1] www.supergenpass.com

spinlock 12y ago

Aren't the cards all different? I assumed it would be a one-time-pad which is much more secure than a simple substitution.

aquark 12y ago
Yes, they are different. But that just makes it a substitution cipher with unique keys. A one time pad requires a key as long as all the messages you want to encode since each key bit is only used once.

wahsd 12y ago

You are making a rather critical mistake; you are not realizing that not only are the character associations variable, but so is the "space bar code", which will be unique for each card. The point being that, although not impossible, it is far more complicated to break the code than you describe here. You are also assuming that everyone will use the full name of the site, e.g., AMAZON, and not simply AZ or AMZN or AMA. For example, I may use YC or YCOMB or YCOMBINATOR for this site, which would also increase the combination exponent..

agwa 12y ago
> You are making a rather critical mistake; you are not realizing that not only are the character associations variable, but so is the "space bar code", which will be unique for each card. I don't know what you mean by "variable" "character associations," but note that my analysis doesn't depend on the space bar code at all, except assuming that it's the first eight characters, which the site's FAQ guarantees. Otherwise my analysis completely ignores it. > You are also assuming that everyone will use the full name of the site, e.g., AMAZON, and not simply AZ or AMZN or AMA. For example, I may use YC or YCOMB or YCOMBINATOR for this site, which would also increase the combination exponent.. True, but there are only a handful of logical choices for any given site. In any case, this is just haggling - the point is that attacks like this shouldn't be possible at all for something claiming to generate "very strong passwords."

deleted 12y ago

[deleted]