Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Partial password usability sucks

gaevoy.com

Post reply on HN
Print view View original

21–30 of 87 posts

Re: Partial password usability sucks

#21

Post by xyzzyz »

inetknght wrote: post #8

> The idea is good it gives you an extra layer of protection against password theft (link 1, link 2, link 3). That sounds obnoxiously insecure on the back-end. Notoriously, the most broken authentication mechanisms used plaintext (or reversibly encrypted) storage. The answers to the three security questions that the article links to also point this out. Sounds like ING Poland needs to be called out by some security r…

The answer in your [0] link is pretty uninformed. The author admits in comments that they never heard about Shamir's secret sharing.

But yes, all of the points raised in the answers [1] are totally valid. The extra security benefit is so small that really not worth the negative impact on usability. System designers should rather focus more on implementing 2FA.

Re: Partial password usability sucks

#22

Post by deepspace »

Matterrr wrote: post #5

> Open partial-password.github.io & copy-paste your password there. Sounds like a great idea, let's all paste our bank passwords in this website! Banks have peculiar ideas about security sometimes, I don't think this partial password business will have a net positive effect (especially if people use "solutions" like these and potentially send their password to a third party)

Exactly this. I have the misfortune of occasionally needing to deal with an online banking portal (located in South Africa) that uses this stupid scheme. Every time I log in, I wish an eternity of torture on the idiots who came up with it.

I just cannot imagine the thought process of the people who though that partial passwords could be better in any way than classic passwords.

Re: Partial password usability sucks

#23

Post by ajuc »

inetknght wrote: post #8

> The idea is good it gives you an extra layer of protection against password theft (link 1, link 2, link 3). That sounds obnoxiously insecure on the back-end. Notoriously, the most broken authentication mechanisms used plaintext (or reversibly encrypted) storage. The answers to the three security questions that the article links to also point this out. Sounds like ING Poland needs to be called out by some security r…

What's more likely - that the bank gets hacked, or that you install a keylogger?

Also there are ways to implement this without keeping the whole password in plaintext/reversibly encrypted. One example I just thought of:

Ask for 75% of the password each time, remember random 1/3rd of that (25% of full password) till the next login together with the hash, and on the next login ask for all the letters you haven't remembered (and fill the ones you remembered, then hash everything and compare).

You can adjust the percentages as needed if having 25% of the password in clear text is too insecure.

Re: Partial password usability sucks

#24

Post by inetknght »

gregmac wrote: post #20
dickeytk wrote: post #12

Earlier quoted context omitted.

I'm not defending this strategy, but you could still do this with hashing. Just create a different hash for different combinations when creating the hash.

Your hash is going to be of a tiny set though, the same as a 4- or 5-character password. That's possible to brute force in seconds , even with the slowest algorithm.

Not only that, but enumerating all possible combinations of 4 or 5 characters from a 20 character password would be untenable.

Re: Partial password usability sucks

#26

Post by IAmLiterallyAB »

ajuc wrote: post #23
inetknght wrote: post #8

> The idea is good it gives you an extra layer of protection against password theft (link 1, link 2, link 3). That sounds obnoxiously insecure on the back-end. Notoriously, the most broken authentication mechanisms used plaintext (or reversibly encrypted) storage. The answers to the three security questions that the article links to also point this out. Sounds like ING Poland needs to be called out by some security r…

What's more likely - that the bank gets hacked, or that you install a keylogger? Also there are ways to implement this without keeping the whole password in plaintext/reversibly encrypted. One example I just thought of: Ask for 75% of the password each time, remember random 1/3rd of that (25% of full password) till the next login together with the hash, and on the next login ask for all the letters you haven't rememb…

So you're still storing part of the plaintext... That's still insecure

Plus, the keylogger could just collect a few logins and it completely defeats the whole thing, so it doesn't help anyway. It's just terrible, it makes everything worse

Re: Partial password usability sucks

#27

Post by munk-a »

inetknght wrote: post #24
gregmac wrote: post #20

Earlier quoted context omitted.

Your hash is going to be of a tiny set though, the same as a 4- or 5-character password. That's possible to brute force in seconds , even with the slowest algorithm.

Not only that, but enumerating all possible combinations of 4 or 5 characters from a 20 character password would be untenable.

Also, if all those combinations were stored would the software use separate salts for each one? Well designed software would but I suspect anyone intelligent enough to consider that would also raise a loud voice at the meeting where this feature was being discussed. They probably use a common salt and if it's known how long (at most) each partial password is (say 5 characters) it's super trivial to generate a rainbow table to break it.

Honestly, even if the salting was done independently per chunk, the fact that you know each chunk is under 5 characters long massively reduces the time to generate a rainbow table to verify the password, even more so if the entry field only allows 36 character entry.

Re: Partial password usability sucks

#28

Post by inetknght »

ajuc wrote: post #23
inetknght wrote: post #8

> The idea is good it gives you an extra layer of protection against password theft (link 1, link 2, link 3). That sounds obnoxiously insecure on the back-end. Notoriously, the most broken authentication mechanisms used plaintext (or reversibly encrypted) storage. The answers to the three security questions that the article links to also point this out. Sounds like ING Poland needs to be called out by some security r…

What's more likely - that the bank gets hacked, or that you install a keylogger? Also there are ways to implement this without keeping the whole password in plaintext/reversibly encrypted. One example I just thought of: Ask for 75% of the password each time, remember random 1/3rd of that (25% of full password) till the next login together with the hash, and on the next login ask for all the letters you haven't rememb…

> What's more likely - that the bank gets hacked, or that you install a keylogger?

Given the (apparent) lack of security for the bank, I'd say the former. IF the bank was actually secure, then sure it'd be more likely for me to have a keylogger.

> Also there are ways to implement this without keeping the whole password in plaintext/reversibly encrypted

Maybe.

> One example I just thought of: Ask for 75% of the password each time, remember random 1/3rd of that (25% of full password) till the next login together with the hash, and on the next login ask for all the letters you haven't remembered (and fill the ones you remembered, then hash everything and compare).

I challenge you to really think about what you're proposing to do. I think it's far more convoluted: it does not solve the keylogger problem and adds complexity to both the client and the server. If you think I'm wrong, then write it up in a spec and show us.

Re: Partial password usability sucks

#29

Post by adwww »

waltbosz wrote: post #6

That's such a strange UI. I couldn't tell you the fifth letter of most words without writing them down, let alone that of my 20 character passwords.

It's used by almost all UK banks as well, sadly. One of my accounts (First Direct) has max length of only 8 characters.

Re: Partial password usability sucks

#30

Post by ajuc »

IAmLiterallyAB wrote: post #26
ajuc wrote: post #23

Earlier quoted context omitted.

What's more likely - that the bank gets hacked, or that you install a keylogger? Also there are ways to implement this without keeping the whole password in plaintext/reversibly encrypted. One example I just thought of: Ask for 75% of the password each time, remember random 1/3rd of that (25% of full password) till the next login together with the hash, and on the next login ask for all the letters you haven't rememb…

So you're still storing part of the plaintext... That's still insecure Plus, the keylogger could just collect a few logins and it completely defeats the whole thing, so it doesn't help anyway. It's just terrible, it makes everything worse

25% of the password. Shouldn't matter that much. And you can change the percentages to for example 10% (asking for 90% of the password each time). Demand slightly longer passwords if that's a big problem.

Hm, actually instead of masking the password to defeat keyloggers they could also just permutate the characters. So that you have to enter password in different order each time. But usability would suck so much :) I prefer the masking.

Also - universal keylogger wouldn't know which characters of the passwords you were asked for. They would need to make a keylogger designed for this bank website so it can understand which characters you provide. And they would need to update the keylogger with updates on the login website (which preasumably would be written in a way that makes it hard to know which characters these are - for example with randomly generated ids of the input fields and provided in random order then positioned with javascript).

I know - security by obscurity. But it does help.

Post reply on HN