Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Partial password usability sucks

gaevoy.com

Post reply on HN
Print view View original

41–50 of 87 posts

Re: Partial password usability sucks

#41

Post by ajuc »

dpark wrote: post #38
ajuc wrote: post #33

Earlier quoted context omitted.

> If you think I'm wrong, then write it up in a spec and show us. Sure. It's fun. On password creation: 0.0. demand 25% longer passwords from users than considered safe 0.1. along with the hash of the whole password remember a randomly choosen 25% of the characters of the password and their positions (in clear text or reversibly encrypted) On each login: 1.0. ask only for the characters in positions you haven't remem…

If you only remember 25% of the characters, then you have to ask for 75% of the characters to generate the full hash. Asking for 75% of the characters defeats the purported reasons for partial password auth.

Why? Now all the universal keyloggers don't work (because they remember which keys were pressed, but not which positions they refer to).

Re: Partial password usability sucks

#42

Post by rhinoceraptor »

ajuc wrote: post #30
IAmLiterallyAB wrote: post #26

Earlier quoted context omitted.

So you're still storing part of the plaintext... That's still insecure Plus, the keylogger could just collect a few logins and it completely defeats the whole thing, so it doesn't help anyway. It's just terrible, it makes everything worse

25% of the password. Shouldn't matter that much. And you can change the percentages to for example 10% (asking for 90% of the password each time). Demand slightly longer passwords if that's a big problem. Hm, actually instead of masking the password to defeat keyloggers they could also just permutate the characters. So that you have to enter password in different order each time. But usability would suck so much :) I…

I'm sure it will help the bank's helpdesk job security, but not much else.

Remembering a specific character of a password is not easy to do, so people will probably type it into notepad and then count to get the right one anyways.

TOTP is much more usable, and probably more secure than inventing your own ridiculous partial password scheme.

Re: Partial password usability sucks

#44

Post by vkou »

ajuc wrote: post #33
inetknght wrote: post #28

Earlier quoted context omitted.

> What's more likely - that the bank gets hacked, or that you install a keylogger? Given the (apparent) lack of security for the bank, I'd say the former. IF the bank was actually secure, then sure it'd be more likely for me to have a keylogger. > Also there are ways to implement this without keeping the whole password in plaintext/reversibly encrypted Maybe. > One example I just thought of: Ask for 75% of the passwo…

> If you think I'm wrong, then write it up in a spec and show us. Sure. It's fun. On password creation: 0.0. demand 25% longer passwords from users than considered safe 0.1. along with the hash of the whole password remember a randomly choosen 25% of the characters of the password and their positions (in clear text or reversibly encrypted) On each login: 1.0. ask only for the characters in positions you haven't remem…

> If I understand correctly - to get the whole password keylogger must be specific to this bank site (to understand which characters are provided), and must be active on at least 4 logins. In my book that's a big improvement.

The difference in difficulty of keylogging 4 logins, and 1 login is, in practice, small. Once your computer is pwned, all bets are off.

Re: Partial password usability sucks

#45

Post by ajuc »

rhinoceraptor wrote: post #42
ajuc wrote: post #30

Earlier quoted context omitted.

25% of the password. Shouldn't matter that much. And you can change the percentages to for example 10% (asking for 90% of the password each time). Demand slightly longer passwords if that's a big problem. Hm, actually instead of masking the password to defeat keyloggers they could also just permutate the characters. So that you have to enter password in different order each time. But usability would suck so much :) I…

I'm sure it will help the bank's helpdesk job security, but not much else. Remembering a specific character of a password is not easy to do, so people will probably type it into notepad and then count to get the right one anyways. TOTP is much more usable, and probably more secure than inventing your own ridiculous partial password scheme.

You just spell your password in your mind and when the character is needed you press the key, when it's not needed you don't. The login site looks like this:

    [x] [ ] [x] [ ] [ ] [ ] [ ] [x] [ ] [ ] [ ] [x] [ ]
And when you press a key it jumps to the next empty field.

Re: Partial password usability sucks

#48

Post by munk-a »

ajuc wrote: post #41
dpark wrote: post #38

Earlier quoted context omitted.

If you only remember 25% of the characters, then you have to ask for 75% of the characters to generate the full hash. Asking for 75% of the characters defeats the purported reasons for partial password auth.

Why? Now all the universal keyloggers don't work (because they remember which keys were pressed, but not which positions they refer to).

I mean... for keyloggers and easier approach is just to distribute some sort of possession authentication device (like a dongle or codes via SMS) where a replayed password will fail to work or... insist that passwords meet some crazy entropy requirements (like 48 characters) and provide download links to password managers that can assist in generating/storing these along with some rudimentary education efforts on the site.

Re: Partial password usability sucks

#49

Post by jotaen »

> If you don’t trust partial-password.github.io consider to save the page locally and run it from there

This doesn’t really make it safe per se, there still can be a script running that triggers an AJAX call in the background, sending the password to some web URL.

Re: Partial password usability sucks

#50

Post by ajuc »

munk-a wrote: post #48
ajuc wrote: post #41

Earlier quoted context omitted.

Why? Now all the universal keyloggers don't work (because they remember which keys were pressed, but not which positions they refer to).

I mean... for keyloggers and easier approach is just to distribute some sort of possession authentication device (like a dongle or codes via SMS) where a replayed password will fail to work or... insist that passwords meet some crazy entropy requirements (like 48 characters) and provide download links to password managers that can assist in generating/storing these along with some rudimentary education efforts on the…

Sms codes are used anyway, to authorize transfers and changes in the account.
Post reply on HN