Another way is to use probabilistic graphical models. The paper "Personalized password guessing: A new security threat" addressed this threat several years ago.
https://experts.illinois.edu/en/publications/personalized-pa...
Using Ordered Markov Chains and User Information to Speed Up Password Cracking
31–40 of 64 posts
Re: Using Ordered Markov Chains and User Information to Speed Up Password Cracking
#32Nice idea! Can anyone point the data. May be we can try RNN to generate the passwords.
Markov chains can do amazing things in password cracking: https://arstechnica.com/security/2013/05/how-crackers-make-m... But an RNN isn't necessarily going to help as much as you think. An RNN has two problems compared to a Markov chain: 1. Markov chains memorize strings very very easily, accurately, and scalably; it's easy to memorize phrases, words, suffixes, and prefixes from the existing corpuses of billions of…
Actually RNNs/LSTMs are surprisingly good at memorizing in addition to generalization. Have a look at the famous blog post "The Unreasonable Effectiveness of Recurrent Neural Networks" [1] for instance and notice how many words it's able to generate from characters. However, your second point is valid.
Re: Using Ordered Markov Chains and User Information to Speed Up Password Cracking
#33Earlier quoted context omitted.
Because you usually don't have control over that. On lots of system, any application that can display an UI can access the current clipboard's contents.
Is there any way to globally disable clipboard access in my browser? Jeez, this sounds horrifying!
I believe the browser is one of the few applications that already take this into account, fortunately. Clipboard access from Javascript is secure, for example.
Re: Using Ordered Markov Chains and User Information to Speed Up Password Cracking
#34Earlier quoted context omitted.
Single point of failure is mitigated by proper backups. Clipboard attacks are mitigated by your password manager clearing your clipboard after paste (either by event or by time).
It's still a single point of failure if the password manager is compromised.
What password management solution doesn't have this aspect?
Re: Using Ordered Markov Chains and User Information to Speed Up Password Cracking
#35Earlier quoted context omitted.
Markov chains can do amazing things in password cracking: https://arstechnica.com/security/2013/05/how-crackers-make-m... But an RNN isn't necessarily going to help as much as you think. An RNN has two problems compared to a Markov chain: 1. Markov chains memorize strings very very easily, accurately, and scalably; it's easy to memorize phrases, words, suffixes, and prefixes from the existing corpuses of billions of…
Actually RNNs/LSTMs are surprisingly good at memorizing in addition to generalization. Have a look at the famous blog post "The Unreasonable Effectiveness of Recurrent Neural Networks" [1] for instance and notice how many words it's able to generate from characters. However, your second point is valid. [1] http://karpathy.github.io/2015/05/21/rnn-effectiveness/
That's not 'surprisingly' good, that's effective only on a small corpus. You can see for yourself that if you try to feed it multiple corpuses with many vocabulary words or proper names, which a Markov chain wouldn't break a sweat on memorizing them all, the RNN has limited memorization ability and what tends to happen is that the less common ones get overwritten in favor of the general grammar of English and the vocabulary of the largest corpus: https://www.gwern.net/RNN%20metadata
Re: Using Ordered Markov Chains and User Information to Speed Up Password Cracking
#36Earlier quoted context omitted.
It's still a single point of failure if the password manager is compromised.
What password management solution doesn't have this aspect?
Random pass phrases written in uv marker on the underside of your desk, in a notebook (bonus: you can burn it once memorized) scrambled and/or hidden among decoy passphrases. Make the phrase long enough (high enough entropy) that you have enough time to memorize it and use it before it should be rotated.
Whether you like this implementation or not, the solution is to choose better passwords.
Re: Using Ordered Markov Chains and User Information to Speed Up Password Cracking
#37Earlier quoted context omitted.
Why would you ever let a site or an unstrusted application access your clipboard?
Because you usually don't have control over that. On lots of system, any application that can display an UI can access the current clipboard's contents.
Taking a step back from the problem, users do usually have some amount of control over what is running on a system.
I mean, I understand that computers managed by typical users will be a shitshow, but much of the problem in that situation is that they don't really care.
Re: Using Ordered Markov Chains and User Information to Speed Up Password Cracking
#38Can we make a characteristic scoring metric to help order password cracking attempts? Is there a standard distribution of characters in passwords that can be analyzed?
Re: Using Ordered Markov Chains and User Information to Speed Up Password Cracking
#39Earlier quoted context omitted.
But single point of failure and also clipboard attacks! :(
Correct me if I'm wrong but if you install a malicious application, aren't you screwed anyway, password in clipboard or not?
On desktop yes. But on mobile, where every app is sandboxed to some degree, not necessarily. Keepass2Android prevents clipboard attacks by installing a keyboard that autotypes your password, never letting it get to the clipboard.
Re: Using Ordered Markov Chains and User Information to Speed Up Password Cracking
#40Earlier quoted context omitted.
What password management solution doesn't have this aspect?
Random pass phrases written in uv marker on the underside of your desk, in a notebook (bonus: you can burn it once memorized) scrambled and/or hidden among decoy passphrases. Make the phrase long enough (high enough entropy) that you have enough time to memorize it and use it before it should be rotated. Whether you like this implementation or not, the solution is to choose better passwords.
If your house burns down, you lose your passwords.
If somemone (burglar / law enforcement / intelligence agencies) breaks in, they have your passwords.
If you are memorizing a lot of passwords (I have 500+ in my password database) you are surely going to forget rarely used ones.
If passwords are written down, they can be demanded from you by a warrant/court order. If they are memorized, they cannot.