Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using Ordered Markov Chains and User Information to Speed Up Password Cracking

fsecurify.com

Post reply on HN
Print view View original

21–30 of 64 posts

Re: Using Ordered Markov Chains and User Information to Speed Up Password Cracking

#21

Post by matrix2596 »

gwern wrote: post #10
matrix2596 wrote: post #4

Nice idea! Can anyone point the data. May be we can try RNN to generate the passwords.

Markov chains can do amazing things in password cracking: https://arstechnica.com/security/2013/05/how-crackers-make-m... But an RNN isn't necessarily going to help as much as you think. An RNN has two problems compared to a Markov chain: 1. Markov chains memorize strings very very easily, accurately, and scalably; it's easy to memorize phrases, words, suffixes, and prefixes from the existing corpuses of billions of…

Nice explanation. Thanks

Its more from a theoretical point of view. I want to try similar (conditioned on user info) to https://github.com/thoppe/5baa61e4c9b93f3f0682250b6cf8331b7e...

Re: Using Ordered Markov Chains and User Information to Speed Up Password Cracking

#22

Post by jwilk »

xeroaura wrote: post #20
jwilk wrote: post #19

Earlier quoted context omitted.

What do you mean by "clipboard attack"?

For sites/apps that can't fetch the password themselves, people usually copy paste the password. This could allow other sites/apps that have access to the clipboard to see the password.

Why would you ever let a site or an unstrusted application access your clipboard?

Re: Using Ordered Markov Chains and User Information to Speed Up Password Cracking

#23

Post by spullara »

xeroaura wrote: post #20
jwilk wrote: post #19

Earlier quoted context omitted.

What do you mean by "clipboard attack"?

For sites/apps that can't fetch the password themselves, people usually copy paste the password. This could allow other sites/apps that have access to the clipboard to see the password.

Another good reason to use iCloud Keychain rather than one of the 3rd party ones.

Re: Using Ordered Markov Chains and User Information to Speed Up Password Cracking

#24

Post by duozerk »

jwilk wrote: post #22
xeroaura wrote: post #20

Earlier quoted context omitted.

For sites/apps that can't fetch the password themselves, people usually copy paste the password. This could allow other sites/apps that have access to the clipboard to see the password.

Why would you ever let a site or an unstrusted application access your clipboard?

Because you usually don't have control over that. On lots of system, any application that can display an UI can access the current clipboard's contents.

Re: Using Ordered Markov Chains and User Information to Speed Up Password Cracking

#25

Post by tmalsburg2 »

throwaway729 wrote: post #15
mattcoles wrote: post #11

Seems like randomly generated passwords kept in a password manager are the way to go then, too much risk in letting our personal details bias password choices.

But single point of failure and also clipboard attacks! :(

Correct me if I'm wrong but if you install a malicious application, aren't you screwed anyway, password in clipboard or not?

Re: Using Ordered Markov Chains and User Information to Speed Up Password Cracking

#26

Post by lqdc13 »

lucb1e wrote: post #17
vog wrote: post #13

Earlier quoted context omitted.

Oh no, it isn't. It just takes quite a while to load.

It is now: blank response with status code 500.

Always baffling to me. HN front page is not that much traffic. Maybe 1 req/s on avg for a few hrs with bursts up to 3 req/s.

Re: Using Ordered Markov Chains and User Information to Speed Up Password Cracking

#27

Post by eikenberry »

throwaway729 wrote: post #15
mattcoles wrote: post #11

Seems like randomly generated passwords kept in a password manager are the way to go then, too much risk in letting our personal details bias password choices.

But single point of failure and also clipboard attacks! :(

Single point of failure is mitigated by proper backups. Clipboard attacks are mitigated by your password manager clearing your clipboard after paste (either by event or by time).

Re: Using Ordered Markov Chains and User Information to Speed Up Password Cracking

#28

Post by mattcoles »

eikenberry wrote: post #27
throwaway729 wrote: post #15

Earlier quoted context omitted.

But single point of failure and also clipboard attacks! :(

Single point of failure is mitigated by proper backups. Clipboard attacks are mitigated by your password manager clearing your clipboard after paste (either by event or by time).

It's still a single point of failure if the password manager is compromised.

Re: Using Ordered Markov Chains and User Information to Speed Up Password Cracking

#29

Post by chongli »

duozerk wrote: post #24
jwilk wrote: post #22

Earlier quoted context omitted.

Why would you ever let a site or an unstrusted application access your clipboard?

Because you usually don't have control over that. On lots of system, any application that can display an UI can access the current clipboard's contents.

Is there any way to globally disable clipboard access in my browser? Jeez, this sounds horrifying!

Re: Using Ordered Markov Chains and User Information to Speed Up Password Cracking

#30

Post by dcosson »

jwilk wrote: post #22
xeroaura wrote: post #20

Earlier quoted context omitted.

For sites/apps that can't fetch the password themselves, people usually copy paste the password. This could allow other sites/apps that have access to the clipboard to see the password.

Why would you ever let a site or an unstrusted application access your clipboard?

I think you're more protected in the browser. On iOS any app can access the clipboard without having to ask for any permission.

The encryption scheme on iOS is nice, but for how much of a game they talk about privacy Apple had the opportunity to do so much more for security around identity/auth and they did approximately nothing.

Post reply on HN