Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What is the origin of passwords submitted to honeypots?

isc.sans.edu

Post reply on HN
Print view View original

21–30 of 44 posts

Re: What is the origin of passwords submitted to honeypots?

#21

Post by dtgriscom »

avidiax wrote: post #7

It's an interesting optimization problem for the attacker. The most common passwords are problematic. They will frequently work, but they will work for the other guy, too. So then the question is "how do you pull up the ladder?" Changing the password is simple, but likely to get the machine reimaged. Looking at the login history would give an allowlist of subnets, which can be used to deny other attackers access, but…

> So then the question is "how do you pull up the ladder?"

I've never heard that metaphor before, but it's a good one. Thanks.

Re: What is the origin of passwords submitted to honeypots?

#22

Post by matkoniecz »

vinay_ys wrote: post #8

Passwords should be dead soon and this article should be irrelevant soon after. PSA: For most basic and routine websites/apps of low-value, please, please use the FaceID/TouchID protected platform authenticators for passwordless authentication. And for those archaic sites that still insist on passwords (why? tell them about passwordless by writing feedback/app reviews), use the platform built-in password managers. Do…

> please use the FaceID/TouchID protected platform authenticators

nope

I am working on basing less critical stuff on Google, not interested in doing exact opposite (or doing the same mistake with Apple)

Re: What is the origin of passwords submitted to honeypots?

#23

Post by NikkiA »

MattPalmer1086 wrote: post #9
vinay_ys wrote: post #8

Passwords should be dead soon and this article should be irrelevant soon after. PSA: For most basic and routine websites/apps of low-value, please, please use the FaceID/TouchID protected platform authenticators for passwordless authentication. And for those archaic sites that still insist on passwords (why? tell them about passwordless by writing feedback/app reviews), use the platform built-in password managers. Do…

Define soon. Passwords, for all their annoyances, will probably be around for a long time. While they are not brilliant at anything, they are good enough on many dimensions. Some disadvantages of the things you mention are: * They don't require specialised hardware * They don't require complicated recovery mechanisms if that hardware is lost, stolen or broken. * Arguably, biometrics should not be used for authenticat…

My bank dropped using passwords back in july.

Now all that protects my account is a 5 digit PIN and SMS, and you can reset the pin via SMS.

I'm glad financial companies hire security minded folks.

Re: What is the origin of passwords submitted to honeypots?

#24

Post by MattPalmer1086 »

NikkiA wrote: post #23
MattPalmer1086 wrote: post #9

Earlier quoted context omitted.

Define soon. Passwords, for all their annoyances, will probably be around for a long time. While they are not brilliant at anything, they are good enough on many dimensions. Some disadvantages of the things you mention are: * They don't require specialised hardware * They don't require complicated recovery mechanisms if that hardware is lost, stolen or broken. * Arguably, biometrics should not be used for authenticat…

My bank dropped using passwords back in july. Now all that protects my account is a 5 digit PIN and SMS, and you can reset the pin via SMS. I'm glad financial companies hire security minded folks.

Well, technically a PIN is a kind of low security password...

Re: What is the origin of passwords submitted to honeypots?

#25

Post by xulres »

nwienert wrote: post #12
throw101010 wrote: post #11

Earlier quoted context omitted.

> please use the FaceID/TouchID protected platform authenticators for passwordless authentication. No, thank you, I don't wear my passwords on my face or my fingers because they need to be secret to serve their purpose. I don't really feel like wearing a balaclava and gloves all the time. Also sometimes I need to change them (if they get compromised, if computing progress made them easier to bruteforce, etc.), and I…

I didn’t know Jason Bourne posted on HN. In all seriousness, where’s the threat of someone taking extremely high resolution scans of your iris unless you are truly rich/powerful/connected.

The problem is not the high resolution scan of black hats it's that every company and your mom wants to store your biometric data in the future... and as we see with passwords most of them can't be trusted.

Re: What is the origin of passwords submitted to honeypots?

#26

Post by PhasmaFelis »

nwienert wrote: post #12
throw101010 wrote: post #11

Earlier quoted context omitted.

> please use the FaceID/TouchID protected platform authenticators for passwordless authentication. No, thank you, I don't wear my passwords on my face or my fingers because they need to be secret to serve their purpose. I don't really feel like wearing a balaclava and gloves all the time. Also sometimes I need to change them (if they get compromised, if computing progress made them easier to bruteforce, etc.), and I…

I didn’t know Jason Bourne posted on HN. In all seriousness, where’s the threat of someone taking extremely high resolution scans of your iris unless you are truly rich/powerful/connected.

The bad guys don't need to scan your biometrics. Every site you log into with TouchID or whatever already has. Passwords get leaked all the time, and when you find out, you change them. You can't change your biometrics.

Re: What is the origin of passwords submitted to honeypots?

#27

Post by hooverd »

nwienert wrote: post #12
throw101010 wrote: post #11

Earlier quoted context omitted.

> please use the FaceID/TouchID protected platform authenticators for passwordless authentication. No, thank you, I don't wear my passwords on my face or my fingers because they need to be secret to serve their purpose. I don't really feel like wearing a balaclava and gloves all the time. Also sometimes I need to change them (if they get compromised, if computing progress made them easier to bruteforce, etc.), and I…

I didn’t know Jason Bourne posted on HN. In all seriousness, where’s the threat of someone taking extremely high resolution scans of your iris unless you are truly rich/powerful/connected.

Well, there's WorldCoin.

Re: What is the origin of passwords submitted to honeypots?

#28

Post by nucleardog »

PhasmaFelis wrote: post #26
nwienert wrote: post #12

Earlier quoted context omitted.

I didn’t know Jason Bourne posted on HN. In all seriousness, where’s the threat of someone taking extremely high resolution scans of your iris unless you are truly rich/powerful/connected.

The bad guys don't need to scan your biometrics. Every site you log into with TouchID or whatever already has. Passwords get leaked all the time, and when you find out, you change them. You can't change your biometrics.

You’re fundamentally misunderstanding how TouchID or FaceID work.

The biometrics authenticate you with the Secure Enclave in your phone. The enrolled biometric data is stored within the Secure Enclave and practically unrecoverable. Authentication is done directly within the Secure Enclave. The connection between the sensor (fingerprint, camera) and Secure Enclave is direct and encrypted.

Conceptually, this is identical to using a passcode or password to unlock your device.

Once the Secure Enclave is unlocked, your phone can use it to sign requests, decrypt data (e.g., stored passwords), etc. The signed request or decrypted password is what’s transmitted to the app, website, or whatever else you’re authenticating against.

Your biometric data never leaves a secure encrypted channel between the sensor and Secure Enclave, and within the Secure Enclave’s own storage.

It’s some seriously cool hardware and the lengths it goes to to mitigate a lot of common and uncommon attacks is impressive. (It has a separate built in voltage and clock monitor with a wider operating envelope so if you try and voltage glitch it, it can lock and disable itself and require a reset. Bet Nintendo wishes they had thought of that.)

There are a _lot_ of details published about this.

Secure Enclave: https://support.apple.com/en-ca/guide/security/sec59b0b31ff/...

Overall platform security: https://support.apple.com/en-ca/guide/security/welcome/web

Re: What is the origin of passwords submitted to honeypots?

#29

Post by vinay_ys »

throw101010 wrote: post #11
vinay_ys wrote: post #8

Passwords should be dead soon and this article should be irrelevant soon after. PSA: For most basic and routine websites/apps of low-value, please, please use the FaceID/TouchID protected platform authenticators for passwordless authentication. And for those archaic sites that still insist on passwords (why? tell them about passwordless by writing feedback/app reviews), use the platform built-in password managers. Do…

> please use the FaceID/TouchID protected platform authenticators for passwordless authentication. No, thank you, I don't wear my passwords on my face or my fingers because they need to be secret to serve their purpose. I don't really feel like wearing a balaclava and gloves all the time. Also sometimes I need to change them (if they get compromised, if computing progress made them easier to bruteforce, etc.), and I…

You can be scammed into entering your password into a random textbox and then relayed on the actual website/app. This is too basic. In case of FaceID/TouchID, the acquiring platform (your mobile phone) has secure device binding and FaceID/TouchID is a local authenticator on that device to use that secure device binding to authenticate. If FaceID/TouchID becomes fakeable, we will move on to some other more secure local authenticator. The point is, you have a rich multi-sensor mobile device as your authenticator.

> Also sometimes I need to change them (if they get compromised, if computing progress made them easier to bruteforce, etc.), and I don't really want to have to use cosmetic surgery when that happens.

That's not how it works. Each hardware device that acquires your FaceID or TouchID (or Iris ID etc) do it in a way that's unique to them. Even mission impossible style face mask can't fool these modern FaceIDs. Like all things in security, it is a game of making it really expensive to break it and not really about it being impossible.

Re: What is the origin of passwords submitted to honeypots?

#30

Post by xenophonf »

vinay_ys wrote: post #29
throw101010 wrote: post #11

Earlier quoted context omitted.

> please use the FaceID/TouchID protected platform authenticators for passwordless authentication. No, thank you, I don't wear my passwords on my face or my fingers because they need to be secret to serve their purpose. I don't really feel like wearing a balaclava and gloves all the time. Also sometimes I need to change them (if they get compromised, if computing progress made them easier to bruteforce, etc.), and I…

You can be scammed into entering your password into a random textbox and then relayed on the actual website/app. This is too basic. In case of FaceID/TouchID, the acquiring platform (your mobile phone) has secure device binding and FaceID/TouchID is a local authenticator on that device to use that secure device binding to authenticate. If FaceID/TouchID becomes fakeable, we will move on to some other more secure loca…

> you have a rich multi-sensor mobile device as your authenticator

YOU, a relatively wealthy programmer/middle manager living in a first-world country, have access to such a device.

Ever think about who you're disenfranchising with tech like this? Or to whom you're ceding socioeconomic power and political influence?

Post reply on HN