Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Flaws in deterministic password managers

tonyarcieri.com

Post reply on HN
Print view View original

11–20 of 106 posts

Re: Flaws in deterministic password managers

#11

Post by ceronman »

Two extra advantages of vault based password managers:

1. The manager can automatically change old passwords for you. LastPass support a big set of websites, when Dropbox was hacked this was very handy. I like to change social media passwords every few months and this makes it very easy.

2. You can store passwords that you can remember if necessary. Sometimes I need to access a password for a service or a site in an environment where I don't have an easy access to my password manager, for example when I'm using a friend's phone or when I SSHd into another machine. In those cases is handy to have some passwords that you remember, but are stored in the vault just in case you forget them. I only do this for a few passwords, but it's a nice feature to have.

Re: Flaws in deterministic password managers

#12

Post by ythn »

zeveb wrote: post #9
ythn wrote: post #3

The only deterministic password manager you need is your own mind. Come up with a set of password rules that are generic enough to accommodate all these issues. For example my deterministic password manager might be: 1. random english wordx2 + first 4 letters of registered domain, all caps + remaining lowercase + number of letters in domain (integer) + symbols associated with digits of the integer digits 2. If site d…

A password like that would probably be guessed by a good password cracker pretty quickly. I've taken the liberty of following your procedure for an un-named domain. If anyone's got a password cracker running, I'd be interested how long it takes to break this SHA256 hash: dae640f98b6894d2f6eab5755b22918be46b0d219ea10d3ceea06ebe538a75d1. Post once you've guessed it. Just use 'pwgen -s 22'; it generates 128-bit password…

I too am interested to see how long it takes assuming the attacker knows the generator ruleset (which he will have had to work out previously from two plaintext passwords of mine).

Still, I don't think it's that easy to figure out the ruleset of a good password generator if you make it obscure enough.

For example:

Amazon: NovemberAlphaies12#

Facebook: KiloFoxtrototto16&

What's the ruleset?

Answer: Phoenic alphabet of last + first letter of domain + italian number representing total letters in domain backwards + integer sum of the digits on either side of each digit in the Italian number + symbol representing sum of the digits of the previously calculated integer repeated until reduced to one digit.

Seems like way too much work for an attacker to try to figure out.

Re: Flaws in deterministic password managers

#13

Post by dvdkon »

I don't agree with the author on many of his points. 1 and 2 are "merely" convenience features. Sure, those things make a truly stateless password manager harder to use and a very niche tool, but they're by no means fatal flaws. 3 is a good argument, but storing existing secrets is by definition out of scope for password generators. It is a usability problem, which makes using a truly stateless password generator as the only password manager harder, but still not a fatal flaw. The fourth one is in my opinion the only one which could be called a fatal flaw. It's probably the thing that has to be considered the most before using a master secret password generator. The hyperbolical title annoys me, but what annoys me probably even more is that the author then recommends (not directly, mentions as his personal choice, but that counts as a "seal of approval" for me) a closed-source cloud password manager, which could possibly be less secure than a password generator.

Re: Flaws in deterministic password managers

#14

Post by tprynn »

libeclipse wrote: post #2

I'm the creator of visionary[0], a deterministic password generator that the article links to. When I thought of the idea (quite a while ago), I thought it was a good idea, and I thought I was the first one there. I was wrong on both accounts. The points that the article makes are right, and people should use conventional passwords over deterministic ones. But I guess it appeals to a certain small subset of people. F…

Not to be too pointed, but would you consider adding this disclaimer to your blog post and github repo? Hopefully that will inform potential users before using a system that could leave them less secure.

Re: Flaws in deterministic password managers

#15

Post by macintux »

ythn wrote: post #10
tptacek wrote: post #6

Earlier quoted context omitted.

First, your proposed scheme relies on doubling words to get complexity without imposing too much of a tax on the user. But because passwords must be reasonable to type, that rule (and any rule like it --- I get that the "key" in this scheme is in part the weird rules you come up with) limits you to smaller words, which can very quickly be searched. Worse, an attacker who sees one of your passwords has a pretty decent…

> Worse, an attacker who sees one of your passwords has a pretty decent shot at brute forcing the rules you use, and an attacker who sees two of them has the rules and has totally cracked your scheme. If an attacker is specifically targeting me and thinking about my passwords, there's not much I can do at that point. Password security in general kind of relies on attackers scanning huge quantities of credentials and…

1Password doesn't ordinarily store your database (although I can't speak to the more recent team/cloud features). It's up to you to decide how to make them available to different devices, via Dropbox e.g.

So, yes, if the attacker has access to your Dropbox and your master password, you're screwed, but that's a very high bar to hurdle.

Re: Flaws in deterministic password managers

#16

Post by eridius »

ythn wrote: post #10
tptacek wrote: post #6

Earlier quoted context omitted.

First, your proposed scheme relies on doubling words to get complexity without imposing too much of a tax on the user. But because passwords must be reasonable to type, that rule (and any rule like it --- I get that the "key" in this scheme is in part the weird rules you come up with) limits you to smaller words, which can very quickly be searched. Worse, an attacker who sees one of your passwords has a pretty decent…

> Worse, an attacker who sees one of your passwords has a pretty decent shot at brute forcing the rules you use, and an attacker who sees two of them has the rules and has totally cracked your scheme. If an attacker is specifically targeting me and thinking about my passwords, there's not much I can do at that point. Password security in general kind of relies on attackers scanning huge quantities of credentials and…

1Password isn't a web-based password manager, it's an offline one that has a syncing component. Syncing is traditionally done either over WiFi (so no exposure to attackers), Dropbox, or iCloud. More recently 1Password now has an optional subscription model that gets you syncing + all updates to the app on all platforms. But the new built-in syncing uses a separate Account Key, which you provide along with your master password the first time you set up syncing on a particular device, and then you never use the account key again (until you have to set up a new device). This means you can store the account key in whatever secure manner you want without needing ease-of-access, and it means you won't ever accidentally type your account key into the wrong place and expose it to an attacker.

So basically, if you use 1Password's built-in syncing, the attacker has to compromise your machine to get at your vault, just as they would have to do if you didn't do any syncing at all. If you use a third-party service for syncing (e.g. Dropbox, iCloud) they have to compromise that service. And of course in both cases they still need your 1Password master password.

Re: Flaws in deterministic password managers

#17

Post by shaftway »

ythn wrote: post #12
zeveb wrote: post #9

Earlier quoted context omitted.

A password like that would probably be guessed by a good password cracker pretty quickly. I've taken the liberty of following your procedure for an un-named domain. If anyone's got a password cracker running, I'd be interested how long it takes to break this SHA256 hash: dae640f98b6894d2f6eab5755b22918be46b0d219ea10d3ceea06ebe538a75d1. Post once you've guessed it. Just use 'pwgen -s 22'; it generates 128-bit password…

I too am interested to see how long it takes assuming the attacker knows the generator ruleset (which he will have had to work out previously from two plaintext passwords of mine). Still, I don't think it's that easy to figure out the ruleset of a good password generator if you make it obscure enough. For example: Amazon: NovemberAlphaies12# Facebook: KiloFoxtrototto16& What's the ruleset? Answer: Phoenic alphabet of…

Frankly, the phonetics were trivial. So it's really...

Amazon: ies12# Facebook: otto16&

"Otto" made me think 8, and that led me to "sei" (I read stuff upside down when reading to my kids, so I flip letter orders easily). It didn't take long to figure out those were the length of the site. So now we're down to....

Amazon: 12# Facebook: 16&

These follow a pattern (digit digit symbol), so even if I didn't notice that the symbols were only those above digits There are about 2000 possible choices. Or 11 bits of entropy.

I didn't understand your number scheme, but I probably don't need to.

Re: Flaws in deterministic password managers

#18

Post by theandrewbailey »

ythn wrote: post #10
tptacek wrote: post #6

Earlier quoted context omitted.

First, your proposed scheme relies on doubling words to get complexity without imposing too much of a tax on the user. But because passwords must be reasonable to type, that rule (and any rule like it --- I get that the "key" in this scheme is in part the weird rules you come up with) limits you to smaller words, which can very quickly be searched. Worse, an attacker who sees one of your passwords has a pretty decent…

> Worse, an attacker who sees one of your passwords has a pretty decent shot at brute forcing the rules you use, and an attacker who sees two of them has the rules and has totally cracked your scheme. If an attacker is specifically targeting me and thinking about my passwords, there's not much I can do at that point. Password security in general kind of relies on attackers scanning huge quantities of credentials and…

> If an attacker is specifically targeting me and thinking about my passwords, there's not much I can do at that point.

Have really long passwords that are extremely random on a bit-by-bit basis and doesn't have a snowball's chance in hell of containing a dictionary word (which are the blindingly killer flaw in your formula). Like: 6vRmÓ£æp¥£{&XèñgäÐë¸pH©Þ|÷g¸jn§/¥ÔÎpV4fÎ or ò\f4¬Ð³ &{W+ãÄçÏ)æý½06Ýzȯ+µ>få²9Æð:WÚuÂ

> Plus, I still don't get why 1Password is better than a password generator on the 4th point.

Because you have credentials that are 100% externally independent of each other. Only you have access to the plaintext passwords (the only way they are related) and you define the terms on which the ciphertext is distributed.

Re: Flaws in deterministic password managers

#19

Post by eridius »

ythn wrote: post #12
zeveb wrote: post #9

Earlier quoted context omitted.

A password like that would probably be guessed by a good password cracker pretty quickly. I've taken the liberty of following your procedure for an un-named domain. If anyone's got a password cracker running, I'd be interested how long it takes to break this SHA256 hash: dae640f98b6894d2f6eab5755b22918be46b0d219ea10d3ceea06ebe538a75d1. Post once you've guessed it. Just use 'pwgen -s 22'; it generates 128-bit password…

I too am interested to see how long it takes assuming the attacker knows the generator ruleset (which he will have had to work out previously from two plaintext passwords of mine). Still, I don't think it's that easy to figure out the ruleset of a good password generator if you make it obscure enough. For example: Amazon: NovemberAlphaies12# Facebook: KiloFoxtrototto16& What's the ruleset? Answer: Phoenic alphabet of…

What do you mean by "integer sum of the digits on either side of each digit in the Italian number"? Your italian number is a word, not a sequence of digits. It looks to me like that number is really just the number of letters in the domain multiplied by 2. And the rest of that password scheme is actually rather trivial to deduce (assuming you can recognize italian numbers).

Re: Flaws in deterministic password managers

#20

Post by slaymaker1907 »

I thought I'd make an account on contribute on this issue as the author of a (probably pretty bad) password manager https://slaymaker1907.github.io/password/, source code at https://github.com/slaymaker1907/password-hasher.

There definitely is an issue with some websites having strange requirements, but the way I get around it is keeping an drive sheet with all information used to generate the password (except for the master password of course). This does add some state, but I find that for common passwords I memorize the method of generation very quickly.

There is a central point of failure if the master password is compromised. However, this can be mitigated by first choosing and memorizing a very strong master password as well as versioning passwords by storing the name of the master password used with the rest of the info (though obviously not the master password itself). Additionally, I find the threat model under which such compromises to not be very convincing assuming you choose a strong master password compared to the common case of simply needing to change a password key on the site from linkedin1 to linkedin2 in case of a password database breach.

One weakness of password vaults is that they don't have the advantage of working without access to the vault. While my method can store state as mentioned above, it is very easy to memorize this state, particularly for common/important passwords and has actually saved my bacon before.

Finally, something that I think is a significant strength to a manager but a weakness for managers is that I can and do use my manager for passwords that I need to type out, most often using a feature that translates the password into a password similar to a diceware password (I use a significantly shorter dictionary since dictionary length does not affect the entropy density of a password very much and it makes them easier to type/remember if only using common words). Using this feature, I've been able to create separate passwords for my desktop, laptop, and phone that are both easy to remember as well as having good entropy (when I compute entropy I do assume that an attacker knows the method of generation).

Post reply on HN