3 ms·

yeah I fail to see how this actually defends against the `I'm going to hit you with this rubber hose until you login` attack

• MagicWishMonkey 12y ago
  If you don't know the password to your system it can't be forced out of you. For example, if you have a password algorithm that takes an input value (lets say a website name) and a seed that is stored on your system somewhere (that you don't have memorized), concats them together and then hashes the result to generate the password, the rubber hose attackers would to both beat the input value out of you and have physical access to the machine your seed is stored on to recover the password.
  • chiph 12y ago
    The trick, it seems, is to be able to convince the guy wielding the rubber hose that you don't have the information he wants. "Give me the password!" "Password to what?" {whack}
  • tedunangst 12y ago
    This is a problem that has been solved by every Hollywood movie ever. The bank vault can only be unlocked by the bank manager? Kidnap bank manager's daughter, tell him to unlock the vault. The person with the password and the person who gets the hose don't have to be the same person.