4 ms·
It's interesting, but it opens up a rather unsettling counter-countermeasure: If I'm Mallet, I don't want people using passwords I can't quickly force out of t
by cbd1984 11y ago
It's interesting, but it opens up a rather unsettling counter-countermeasure:
If I'm Mallet, I don't want people using passwords I can't quickly force out of them. Therefore, I pretend I don't know about this, or don't believe it, and keep using the rubber hose on people who are implementing this protocol. Therefore, those people get worked over longer and end up in a worse spot than people who are able to give up a password quickly. Net result is that people are terrified of using this stuff because they know that if they don't give up a working password quickly they'll be tortured longer.
Moral: This is probably a really good way to remember secure (that is, high-entropy) passwords. Don't pretend it's good for a use-case at which it is very obviously a horrible fit.
- po 11y agoThe best technique for this that I have seen are systems with plausible deniability. This is where you have a pool of seemingly random data and several passwords will open different parts of the data up, with the free space padded by random data. The idea is that you reveal a password with dummy content. If they continue to insist that there must be another password you can reveal a second, or third password that will reveal different data. Of course, any actor that is willing to torture an answer out of you is probably willing to torture n answers out of you and/or watch you die in the process. This is one of those problems that there may not be a technological solution to and we should probably focus on spreading the concept of human rights to our children instead.
- darkmighty 11y agoPlausible deniability really is the best tool I can really think in this case, specially if the attacker is not aware of that possibility (it should be concealed as much as possible).
- digi_owl 11y ago> Of course, any actor that is willing to torture an answer out of you is probably willing to torture n answers out of you and/or watch you die in the process. The eternal question of how to fight monsters without becoming one in the process.