Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Partial password usability sucks

gaevoy.com

Post reply on HN
Print view View original

71–80 of 87 posts

Re: Partial password usability sucks

#71

Post by cbsks »

gbear605 wrote: post #64
ajuc wrote: post #57

Earlier quoted context omitted.

Well, yes, it's slower. But not by much. A few seconds.

Some of my passwords I have memorized only as muscle memory. Without going into too much detail, if I didn’t have a qwerty keyboard, I wouldn’t be able to enter it without a couple minutes of thinking “okay, this key is there on a qwerty keyboard...”

I have exactly the same issue with my passwords. I can remember what the letters, numbers, and symbols are, but I can only remember which letters are uppercase by typing it out on a keyboard.

Re: Partial password usability sucks

#72

Post by ajuc »

ljm wrote: post #61
ajuc wrote: post #41

Earlier quoted context omitted.

Why? Now all the universal keyloggers don't work (because they remember which keys were pressed, but not which positions they refer to).

Keyloggers don't wrap themselves up after the first log in. They could easily take the data from several log-ins (if they can't scan the HTML) and eventually get a complete password. Besides which, the partial login isn't random either. It's always sequential. You'll never be asked to enter character 3, then 1, then 8. It will always be asked in the same order as the password string itself.

> It's always sequential.

It's monotonic, but not sequential. On one login you will be asked for positions 1,3,4,7,9, 10, on another you will be asked for letters 1,2,5,6,7,8. Merging such partial information isn't trivial if you don't know which positions you got.

Let's say you have 16-letter password. That's 4 missing letters during each login.

There's (16 over 4) = 1820 possible ways that the characters the keylogger see can be positioned in the real password.

Re: Partial password usability sucks

#73

Post by ajuc »

gbear605 wrote: post #64
ajuc wrote: post #57

Earlier quoted context omitted.

Well, yes, it's slower. But not by much. A few seconds.

Some of my passwords I have memorized only as muscle memory. Without going into too much detail, if I didn’t have a qwerty keyboard, I wouldn’t be able to enter it without a couple minutes of thinking “okay, this key is there on a qwerty keyboard...”

I create my passwords from long, easy-to-remember sentences that I sample to be like 15-25 characters long with capitalization and special characters added in a pattern.

Makes it easy to remember the password without muscle memory.

Re: Partial password usability sucks

#74

Post by snorremd »

The solution to keyloggers is not partial passwords. The solution is requiring two factors! In Norway there is a shared authentication infrastructure used by banks and other services called BankID: https://www.bankid.no/en/private/ They facilitate second factor auth either with an OTP device or via your cell phone's sim card. It just works.

All Norwegian banks use a password + second factor. And these days I think most of them have liberal password rules, in that you are allowed quite long passwords. Schemes like the one described in the post seems like a poor attempt at improving security.

Re: Partial password usability sucks

#75

Post by dTal »

vkou wrote: post #44
ajuc wrote: post #33

Earlier quoted context omitted.

> If you think I'm wrong, then write it up in a spec and show us. Sure. It's fun. On password creation: 0.0. demand 25% longer passwords from users than considered safe 0.1. along with the hash of the whole password remember a randomly choosen 25% of the characters of the password and their positions (in clear text or reversibly encrypted) On each login: 1.0. ask only for the characters in positions you haven't remem…

> If I understand correctly - to get the whole password keylogger must be specific to this bank site (to understand which characters are provided), and must be active on at least 4 logins. In my book that's a big improvement. The difference in difficulty of keylogging 4 logins, and 1 login is, in practice, small. Once your computer is pwned, all bets are off.

I think there's a big difference between capturing the whole password at once, and having to reconstruct it contextually - it may be difficult to recover the typing context. Even if the context is known 100% reliably, it will take far more than 4 logins to scrape enough information to reconstruct the password - you need overlap to match the fragments. It the user visits any other site that uses a similar scheme, it gets harder. If a a site chooses to 'salt' the password by making the user retype random characters, it gets much harder - now you need enough logins to apply statistical analysis. If the site makes the user type the characters in the wrong order, you can't reassemble the password at all - all you can do is guess the order.

To gather enough contextual information to defeat all this reliably, the keylogger would also need to be a screen scraper, internet monitor, etc. Straight away, this defeats the not-uncommon case of the inline USB keylogger.

Re: Partial password usability sucks

#76

Post by fjeuplos »

Matterrr wrote: post #5

> Open partial-password.github.io & copy-paste your password there. Sounds like a great idea, let's all paste our bank passwords in this website! Banks have peculiar ideas about security sometimes, I don't think this partial password business will have a net positive effect (especially if people use "solutions" like these and potentially send their password to a third party)

https://github.com/ByteDev/ByteDev.PasswordMask

Similar thing but .NET windows app.

And yes pasting your password into some guys website is ridiculous :p

Re: Partial password usability sucks

#77

Post by fjeuplos »

tedunangst wrote: post #9

Make your security policy difficult enough to comply with, and people will find workarounds like pasting their passwords into strangers' websites.

Or people will just pick short passwords so its easier to count along the chars in their head. Again, not a thing we really want to encourage.

Re: Partial password usability sucks

#78

Post by fjeuplos »

ajuc wrote: post #17
waltbosz wrote: post #6

That's such a strange UI. I couldn't tell you the fifth letter of most words without writing them down, let alone that of my 20 character passwords.

You just spell it in your mind going through all the letters and only press keys where asked. I'm recently switched from a bank that uses regular passwords to a bank that uses partial passwords, and it took me a week or so to get used to this, and it is a little slower (takes me like 10 seconds instead of 1), but it's nothing significant.

You have made the assumption that everyone who uses strong passwords can remember them in their head :-)

Re: Partial password usability sucks

#80

Post by inetknght »

ajuc wrote: post #72
ljm wrote: post #61

Earlier quoted context omitted.

Keyloggers don't wrap themselves up after the first log in. They could easily take the data from several log-ins (if they can't scan the HTML) and eventually get a complete password. Besides which, the partial login isn't random either. It's always sequential. You'll never be asked to enter character 3, then 1, then 8. It will always be asked in the same order as the password string itself.

> It's always sequential. It's monotonic, but not sequential. On one login you will be asked for positions 1,3,4,7,9, 10, on another you will be asked for letters 1,2,5,6,7,8. Merging such partial information isn't trivial if you don't know which positions you got. Let's say you have 16-letter password. That's 4 missing letters during each login. There's (16 over 4) = 1820 possible ways that the characters the keylog…

When computers can generate billions of hashes per second, what makes you think a mere 1820 possible considerations are significant?
Post reply on HN