3 ms·

What is the point of decoding this back into the user's original "ENIGMA" and "AMAZON" strings? In this case, "sh(/J3HqAfQsu..u.rqf" is the user's password. If

What is the point of decoding this back into the user's original "ENIGMA" and "AMAZON" strings? In this case, "sh(/J3HqAfQsu..u.rqf" is the user's password. If you have that, there is nothing to crack. Edit: I see "Combine with another compromised password, and we're coming dangerously close to being able to generate a password for any arbitrary website.", which means that if an attacker could obtain a couple of these passwords, they could determine (a lot of) your qwertycard and gain access to more of your accounts. However, by the time an attacker has any of your passwords, I'm not sure that reverse engineering your qwertycard is an issue. As others put better than I, this would also mean that in addition to obtaining one or more plaintext passwords, the attacker would have to be targeting you specifically and know how you generated the passwords.

ivanhoe 12y ago
Not necessarily, if this card ever gets popular enough that it's worth the trouble in a first place, cracker can simply presume that at least some of the leaked passwords are created with it. He can then just go though the passwords one by one, decipher the last segment (this can be done very quickly), substitute it with the encrypted email domain (the email is also in the leaked DB) and check if the login works. If vulnerable passwords are in the DB they will all be found, and fairly fast, too. Once the cracker gets access to you email account all your bases are belong to him, he can then get even into the sites where you didn't use the password card at all, simply by using the forgotten pass link.
hrjet 12y ago
> If you have that, there is nothing to crack. Alice is a system administrator of xyz.com. She has access to the password that Bob uses on xyz.com. By reverse engineering Bob's password on xyz.com, Alice can then attack Bob's account on pqr.com.
- dippyskoodlez 12y ago
  Unless you use pqr<space>, or cut space in half. Then that entire design goes out the window.

ivanhoe 12y ago

Not necessarily, if this card ever gets popular enough that it's worth the trouble in a first place, cracker can simply presume that at least some of the leaked passwords are created with it. He can then just go though the passwords one by one, decipher the last segment (this can be done very quickly), substitute it with the encrypted email domain (the email is also in the leaked DB) and check if the login works. If vulnerable passwords are in the DB they will all be found, and fairly fast, too. Once the cracker gets access to you email account all your bases are belong to him, he can then get even into the sites where you didn't use the password card at all, simply by using the forgotten pass link.

hrjet 12y ago

> If you have that, there is nothing to crack. Alice is a system administrator of xyz.com. She has access to the password that Bob uses on xyz.com. By reverse engineering Bob's password on xyz.com, Alice can then attack Bob's account on pqr.com.

dippyskoodlez 12y ago
Unless you use pqr<space>, or cut space in half. Then that entire design goes out the window.