Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Partial password usability sucks

gaevoy.com

Post reply on HN
Print view View original

11–20 of 87 posts

Re: Partial password usability sucks

#11

Post by kazinator »

Jawdrop ... that is the most idiotic thing I've been made aware of in quite some time.

First of all, never mind all the gaping usability problems and obvious decrement in security.

The system must be storing passwords in plain text in order to make this work.

I can think of ways that don't require plain text storage (like pre-computing various partial passwords and hashing them separately), but (1) people who came up with this idea would be too stupid to have implemented that, and, (2) in practical terms, it significantly reduces the possible number of partial passwords: we can't hash all of the subsequences of the string, because there are vastly many, so we have to rather generate some reasonable number of canned subsequence positions. Such a reduction in itself is a security compromise.

Re: Partial password usability sucks

#12

Post by dickeytk »

inetknght wrote: post #8

> The idea is good it gives you an extra layer of protection against password theft (link 1, link 2, link 3). That sounds obnoxiously insecure on the back-end. Notoriously, the most broken authentication mechanisms used plaintext (or reversibly encrypted) storage. The answers to the three security questions that the article links to also point this out. Sounds like ING Poland needs to be called out by some security r…

I'm not defending this strategy, but you could still do this with hashing. Just create a different hash for different combinations when creating the hash.

Re: Partial password usability sucks

#14

Post by andrewla »

_asummers wrote: post #7

Perhaps I'm misunderstanding the security model behind this, but why should the site be storing my password's length at all? Why does it know I have a 10th character at all? The site should just have a hash of my password (normalizing the length).

I can't think of any way that this could be made secure outside of specialized hardware. If a system exists that can query some static data for whether a selected subset of characters is correct, then brute-forcing the underlying password becomes stupidly trivial.

Similarly for pre-hashing certain subsets; a four-character password can be too easily brute forced.

Re: Partial password usability sucks

#16

Post by buboard »

john-radio wrote: post #10
_asummers wrote: post #7

Perhaps I'm misunderstanding the security model behind this, but why should the site be storing my password's length at all? Why does it know I have a 10th character at all? The site should just have a hash of my password (normalizing the length).

I guess (hope) they just have a collection of patterns that they apply (like (3, 9, 11, 12, 15) from the OP), and when they store your password's hash, they also store the hash of those several characters so that they can present the pattern to you later and check whether you matched the pattern correctly.

so they have built a rainbow table ready to download

Re: Partial password usability sucks

#17

Post by ajuc »

waltbosz wrote: post #6

That's such a strange UI. I couldn't tell you the fifth letter of most words without writing them down, let alone that of my 20 character passwords.

You just spell it in your mind going through all the letters and only press keys where asked.

I'm recently switched from a bank that uses regular passwords to a bank that uses partial passwords, and it took me a week or so to get used to this, and it is a little slower (takes me like 10 seconds instead of 1), but it's nothing significant.

Re: Partial password usability sucks

#18

Post by Vendan »

john-radio wrote: post #10
_asummers wrote: post #7

Perhaps I'm misunderstanding the security model behind this, but why should the site be storing my password's length at all? Why does it know I have a 10th character at all? The site should just have a hash of my password (normalizing the length).

I guess (hope) they just have a collection of patterns that they apply (like (3, 9, 11, 12, 15) from the OP), and when they store your password's hash, they also store the hash of those several characters so that they can present the pattern to you later and check whether you matched the pattern correctly.

5 characters is "pretty simple to bruteforce" area, and now you've got 5 characters, replicate that for the other patterns, and you can probably crack the whole password pretty easy

Re: Partial password usability sucks

#19

Post by diminoten »

kazinator wrote: post #15

Coming soon to a Poland near you: partial fingerprint authentication at ATMs: "Please put these tiny stickers in the correct locations on your thumb, and then press it against the sensor ..."

How about "Spit on this sensor to see your checking account balance"?

Re: Partial password usability sucks

#20

Post by gregmac »

dickeytk wrote: post #12
inetknght wrote: post #8

> The idea is good it gives you an extra layer of protection against password theft (link 1, link 2, link 3). That sounds obnoxiously insecure on the back-end. Notoriously, the most broken authentication mechanisms used plaintext (or reversibly encrypted) storage. The answers to the three security questions that the article links to also point this out. Sounds like ING Poland needs to be called out by some security r…

I'm not defending this strategy, but you could still do this with hashing. Just create a different hash for different combinations when creating the hash.

Your hash is going to be of a tiny set though, the same as a 4- or 5-character password. That's possible to brute force in seconds, even with the slowest algorithm.
Post reply on HN