Using Ordered Markov Chains and User Information to Speed Up Password Cracking • Hacker News Board

Re: Using Ordered Markov Chains and User Information to Speed Up Password Cracking

#61

Post by Buge » Mon, Feb 27, 2017, 12:40 AM UTC

landryraccoon wrote: post #57

Buge wrote: post #52

Earlier quoted context omitted.

Like you point out, my everyday desktop is already not very secure. I use most of my high value accounts fairly frequently. So most of my accounts would be compromised regardless of what password scheme I use. Installing an open source password manager doesn't lower my security by much. Previously I tried to memorize passwords. I ended up forgetting a lot. It was frustrating trying to remember what my password was, o…

See, for your video game accounts imo writing down your password is just a no brainer. Unless you're protecting your account from family members or roommates, nobody is going to steal a piece of paper. And what government agency cares about your video game passwords? If they want to get into your blizzard account they'll just ask blizzard for access.

I have had family members play pranks on me, so that is one attack I'm trying to avoid. But even ignoring that there are problems. Do I keep the paper at my desk? If so, what do I do if I want to log in on my phone when I'm not at home? And like I said, there's the risk of the house burning down. My house is kind of a mess, and I have lost pieces of paper before. I could keep it in my wallet, but what if I lose my wallet? I guess I could keep multiple pieces of paper, but that just increases the chance that I would lose one. And I then I have to worry about keeping the papers in sync. And it's not just the video game account, they also attack the email associated with the video game account, so I have to put that there too. And then the recovery email for that email. Maybe I need to put my cell provider password there too, because people hijack mobile phone numbers some times for sms account hijacking. This just leads to a paperwork overhead problem that would be better for a computer to solve. Digging through my wallet or digging around my desk trying to find a piece of paper, and then typing a password character by character from the paper sounds really annoying.

I don't see what benefit the paper would have. Whether it's paper or a password manager, if my computer is compromised they'll get my accounts with a keylogger.

Re: Using Ordered Markov Chains and User Information to Speed Up Password Cracking

#62

Post by __ddd__ » Mon, Feb 27, 2017, 2:06 PM UTC

Buge wrote: post #61

landryraccoon wrote: post #57

Earlier quoted context omitted.

See, for your video game accounts imo writing down your password is just a no brainer. Unless you're protecting your account from family members or roommates, nobody is going to steal a piece of paper. And what government agency cares about your video game passwords? If they want to get into your blizzard account they'll just ask blizzard for access.

I have had family members play pranks on me, so that is one attack I'm trying to avoid. But even ignoring that there are problems. Do I keep the paper at my desk? If so, what do I do if I want to log in on my phone when I'm not at home? And like I said, there's the risk of the house burning down. My house is kind of a mess, and I have lost pieces of paper before. I could keep it in my wallet, but what if I lose my wa…

An attack that requires installing a keylogger and communicating the results over a period of time is less robust than an attack that searches your system for passwords at rest. How often do you lose your wallet? Hopefully less often than you change your passwords...

Re: Using Ordered Markov Chains and User Information to Speed Up Password Cracking

#63

Post by __ddd__ » Mon, Feb 27, 2017, 2:15 PM UTC

robin_reala wrote: post #53

Buge wrote: post #40

Earlier quoted context omitted.

If your house burns down, you lose your passwords. If somemone (burglar / law enforcement / intelligence agencies) breaks in, they have your passwords. If you are memorizing a lot of passwords (I have 500+ in my password database) you are surely going to forget rarely used ones. If passwords are written down, they can be demanded from you by a warrant/court order. If they are memorized, they cannot.

Specifically that’s true for US law. Under UK law memorised passwords can be demanded with prison sentences for failing to produce them. It also doesn’t count at the Us border.

That's messed up. In this case, store password DB in deniable TrueCrypt (or similar) volume on an airgapped machine, secured with a memorized passphrase. That way, they can't prove there's something to decrypt, and you haven't memorized any passwords they know about. But it sounds like merely failing to produce a password is a crime in general, which seems unfair to those who have lost / forgotten their password.

Re: Using Ordered Markov Chains and User Information to Speed Up Password Cracking

#64

Post by Buge » Wed, Mar 01, 2017, 4:50 AM UTC

__ddd__ wrote: post #62

Buge wrote: post #61

Earlier quoted context omitted.

I have had family members play pranks on me, so that is one attack I'm trying to avoid. But even ignoring that there are problems. Do I keep the paper at my desk? If so, what do I do if I want to log in on my phone when I'm not at home? And like I said, there's the risk of the house burning down. My house is kind of a mess, and I have lost pieces of paper before. I could keep it in my wallet, but what if I lose my wa…

An attack that requires installing a keylogger and communicating the results over a period of time is less robust than an attack that searches your system for passwords at rest. How often do you lose your wallet? Hopefully less often than you change your passwords...

Either way they have to communicate online, and either way there is some data on my disk (cookies). Storing my 500+ password on paper is just not practical, and just storing a small fraction doesn't help much because those would be the most frequently used ones.

I've never lost my wallet, but my brother lost his a couple months ago. I never really change my passwords except when I was switching from my old crap password to unique strong passwords in my database. The problem with losing my wallet would be that I would lost access to all my accounts if that was the only copy of the paper. It would be an availability problem.