Partial password usability sucks • Hacker News Board

Re: Partial password usability sucks

#51

Post by gbear605 » Wed, Mar 06, 2019, 10:18 PM UTC

ajuc wrote: post #45

rhinoceraptor wrote: post #42

Earlier quoted context omitted.

I'm sure it will help the bank's helpdesk job security, but not much else. Remembering a specific character of a password is not easy to do, so people will probably type it into notepad and then count to get the right one anyways. TOTP is much more usable, and probably more secure than inventing your own ridiculous partial password scheme.

You just spell your password in your mind and when the character is needed you press the key, when it's not needed you don't. The login site looks like this: [x] [ ] [x] [ ] [ ] [ ] [ ] [x] [ ] [ ] [ ] [x] [ ] And when you press a key it jumps to the next empty field.

I don’t spell passwords in my mind; I have muscle memory for the password.

Re: Partial password usability sucks

#52

Post by ithinkthimgs » Wed, Mar 06, 2019, 10:21 PM UTC

jotaen wrote: post #49

> If you don’t trust partial-password.github.io consider to save the page locally and run it from there This doesn’t really make it safe per se, there still can be a script running that triggers an AJAX call in the background, sending the password to some web URL.

I think the assumption is that you would check the source code before executing it.

Re: Partial password usability sucks

#53

Post by ithinkthimgs » Wed, Mar 06, 2019, 10:24 PM UTC

adwww wrote: post #29

waltbosz wrote: post #6

That's such a strange UI. I couldn't tell you the fifth letter of most words without writing them down, let alone that of my 20 character passwords.

It's used by almost all UK banks as well, sadly. One of my accounts (First Direct) has max length of only 8 characters.

That is criminally poor. The most likely point of failure in most bank accounts nowadays is not the bank, it's the online banking portal. 8 characters is stupidly poor for potentially complete access to your bank account.

I hope they insist you use one of those card readers too.

Re: Partial password usability sucks

#54

Post by NotAnEconomist » Wed, Mar 06, 2019, 10:32 PM UTC

munk-a wrote: post #31

Partial passwords are a terrible idea for a multitude of reasons but one in particular stands out to me. We have come to the general conclusion that humans shouldn't remember their passwords, they should remember one complicated pass key that is linked to a number of otherwise inaccessible secret keys used to interact with servers but, let's step back for a moment and assume people are remembering their passwords (wh…

Advice and tactics for passwords have been bad for a long time, perhaps even comically so:

https://imgs.xkcd.com/comics/password_strength.png

Re: Partial password usability sucks

#55

Post by franky47 » Wed, Mar 06, 2019, 10:41 PM UTC

jdashg wrote: post #3

"Please enter your password in this mutable github pages page." Eek. I have a real desire for a document firewall mode where nothing can enter or leave.

Nor be stored for later retrieval.

Such a firewall, when disabled, would essentially have to restore the whole page memory to how it was when it was enabled, and block access to localStorage / IndexedDB / Cookies / Cache.

Re: Partial password usability sucks

#56

Post by munk-a » Wed, Mar 06, 2019, 10:44 PM UTC

NotAnEconomist wrote: post #54

munk-a wrote: post #31

Partial passwords are a terrible idea for a multitude of reasons but one in particular stands out to me. We have come to the general conclusion that humans shouldn't remember their passwords, they should remember one complicated pass key that is linked to a number of otherwise inaccessible secret keys used to interact with servers but, let's step back for a moment and assume people are remembering their passwords (wh…

Advice and tactics for passwords have been bad for a long time, perhaps even comically so: https://imgs.xkcd.com/comics/password_strength.png

I agree, and a concise response to this article can pretty much be summed up as "Don't roll your own security" for... the fun of it I suppose, I wanted to take a swing at one particularly (IMO) good tear down of why it's stupid for technical reasons, but simply rubber stamping "Don't roll your own security" is pretty acceptable on any of these proposals.

This stuff is complicated, if you're a professional at it good on you, it's a tough job, otherwise... just listen to the professionals/best practices and don't feel the urge to be creative, you'll probably break something. It is possible that everyone is wrong, but it's unlikely... and when everyone is wrong (for example Dual_EC_DRBG) if you're using that system it'll be hard not to be aware of the issue when it comes to light.

Re: Partial password usability sucks

#57

Post by ajuc » Wed, Mar 06, 2019, 10:52 PM UTC

gbear605 wrote: post #51

ajuc wrote: post #45

Earlier quoted context omitted.

You just spell your password in your mind and when the character is needed you press the key, when it's not needed you don't. The login site looks like this: [x] [ ] [x] [ ] [ ] [ ] [ ] [x] [ ] [ ] [ ] [x] [ ] And when you press a key it jumps to the next empty field.

I don’t spell passwords in my mind; I have muscle memory for the password.

Well, yes, it's slower. But not by much. A few seconds.

Re: Partial password usability sucks

#58

Post by WorldMaker » Wed, Mar 06, 2019, 11:18 PM UTC

deepspace wrote: post #22

Matterrr wrote: post #5

> Open partial-password.github.io & copy-paste your password there. Sounds like a great idea, let's all paste our bank passwords in this website! Banks have peculiar ideas about security sometimes, I don't think this partial password business will have a net positive effect (especially if people use "solutions" like these and potentially send their password to a third party)

Exactly this. I have the misfortune of occasionally needing to deal with an online banking portal (located in South Africa) that uses this stupid scheme. Every time I log in, I wish an eternity of torture on the idiots who came up with it. I just cannot imagine the thought process of the people who though that partial passwords could be better in any way than classic passwords.

Banks especially seem heavily "invested" in finding the biggest/laziest loopholes in security laws that they can and driving forklifts through them for as long as possible.

In the 90s, laws in multiple countries asked banks to research and implement Two-Factor security. They invented all of these stupid, stupid Wish-It-Were-Two-Factor things that are not Two-Factor but "feel Two-Factor enough" to avoid actually deploying proper 2FA, but avoid security fines: "Security Questions" (bonus passwords, still 1FA), multi-step login with "user selected pictures" (not an extra factor, just a silly memory game to potentially cut down on phishing), "partial passwords" (still 1FA).

(Then other idiot sites copy these "security best practices" because Banks use them, rather than actual security best practices.)

It is starting to seem like a lot of the money spent on the development effort of these "not 2FA" workarounds and portal workflows could easily have just paid for sending every bank customer a YubiKey or three by now.

Re: Partial password usability sucks

#59

Post by ggggtez » Thu, Mar 07, 2019, 12:10 AM UTC

I'd love to run some math on the entropy this actually gives you... If you assume people are using common dictionary word passwords, you could even develop special tables based on common letter positions or substrings.

Assuming a character is 5 bits of entropy...

An 8 character password gives you 8 choose 4 = 70 possible variations it could ask. Each variation is 4 characters (20 bits of entropy). So, that brings it up to 20+log2(70)=26.1 bits of entropy for an 8 character password... Compared to 40 bits of entropy normally...

And that's not even accounting for using common words/phrases. This scheme seems to lose about 1/3 the entropy.

12 character password gives only... 28.9 bits of entropy instead of the expected 60 bits.

And that's not even including more obvious attacks like stealing the plaintext from the server, since it obviously isn't salted on the server side (and it reveals the length of your password on the front end too??)

Edit: I noticed I used "choose 4" instead of "choose 5" but the math is similarly bad. I leave it as an exercise for the reader.

Re: Partial password usability sucks

#60

Post by ggggtez » Thu, Mar 07, 2019, 12:15 AM UTC

ggggtez wrote: post #59

I'd love to run some math on the entropy this actually gives you... If you assume people are using common dictionary word passwords, you could even develop special tables based on common letter positions or substrings. Assuming a character is 5 bits of entropy... An 8 character password gives you 8 choose 4 = 70 possible variations it could ask. Each variation is 4 characters (20 bits of entropy). So, that brings it…

And an 12 character password only giving you ~500 possible subselections means if the 4 character string was stolen, you could brute force in within a few minutes. This is hardly better than than just leaking the entire password.