Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Unbreakable crypto: Store a 30-character password in your subconscious memory

extremetech.com

Post reply on HN
Print view View original

21–30 of 91 posts

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#21

Post by rytis »

bunderbunder wrote: post #17

Nitpick: This is not unbreakable crypto. This is more of a more secure key storage mechanism. Perhaps also a good defense against phishing attacks. And it's not unbreakable. For starters, this system absolutely requires that the passwords be stored in the clear.

What about encrypting your 'secret' password with normal password? So you get assigned this 30 characters password, which you learn. Then you use normal password (like 'password123' :) ) to encrypt that string. Then when you need to log on, you first type in you normal password to decrypt your 'secret' password, which is then used to authenticate you further. I know, sounds ridiculous, just thinking out loud.

edit: yes, i know, encrypting the key with another string makes it just that tiny little bit secure, technically it's still plain text...

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#22

Post by noahc »

peterwwillis wrote: post #19

This is basically the same method I use for laptop hard disk encryption. I don't remember the password, but I typed it so many times my fingers remember exactly the pattern to type. Kind of like playing a piano. Several times i've been drinking and am unable to remember how to log into my machine, because I can't replicate the pattern and don't remember the password. After 15 minutes of concentration it comes back.

I don't even need to be drinking, but sometimes I'll fat finger it a few times and get frustrated. The only way I can get logged in is to type really really fast.

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#23

Post by colanderman »

mrsebastian wrote: post #11
colanderman wrote: post #8

Beside the title being misleading (it's a 30-symbol password, not 30-character, as "character" implies printable ASCII to most people), the math doesn't quite make sense: Before running, the game creates a random sequence of 30 letters chosen from S, D, F, J, K, and L, with no repeating characters. This equates to around 38 bits of entropy So that's 6 choices for the first character, and 5 choices for each of the nex…

Yep, from the research paper, page 4: http://bojinov.org/professional/usenixsec2012-rubberhose.pdf

Ahh, wow. Thanks. This was totally glossed over in the article copy:

We only use 30-character sequences that correspond to an Euler cycle in the graph shown in Figure 2 (i.e. a cycle where every edge appears exactly once). These sequences have the property that every non- repeating bigram over S (such as ‘sd’, ‘dj’, ’fk’) appears exactly once. In order to anticipate the next item (e.g., to show a performance advantage), it is necessary to learn associations among groups of three or more items. This eliminates learning of letter frequencies or common pairs of letters, which reduces conscious recognition of the embedded repeating sequence [5].

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#24

Post by vecinu »

DanBC wrote: post #20

> It also gives you deniability: If a judge or policeman orders you to hand over your password, you can plausibly say that you don’t actually know it The UK law requires that you make the encrypted data intelligible. Since you have encrypted data there's a pretty good chance you have the software to decrypt it. "They" don't want the password, they want the data. Failing to make the data intelligible (whether that's f…

To add to that, the article doesn't make it clear why torture wouldn't work...

One can torture you until you start attempting to input the password and recover it from your neurological pathways. A password is a password, it doesn't matter how you're storing it because it can be retrieved.

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#26

Post by peterwwillis »

noahc wrote: post #22
peterwwillis wrote: post #19

This is basically the same method I use for laptop hard disk encryption. I don't remember the password, but I typed it so many times my fingers remember exactly the pattern to type. Kind of like playing a piano. Several times i've been drinking and am unable to remember how to log into my machine, because I can't replicate the pattern and don't remember the password. After 15 minutes of concentration it comes back.

I don't even need to be drinking, but sometimes I'll fat finger it a few times and get frustrated. The only way I can get logged in is to type really really fast.

Yeah, I find speed is important too. The quicker you can type it, the easier it is to recall. Another thing, if I slow down I notice i'm sort of humming parts of the pattern in my head, as if each character held a sort of audible weight that indicates where my fingers should go next... again, kind of like playing an instrument. Yet I can't play anything. Weird.

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#27

Post by apl »

peterwwillis wrote: post #19

This is basically the same method I use for laptop hard disk encryption. I don't remember the password, but I typed it so many times my fingers remember exactly the pattern to type. Kind of like playing a piano. Several times i've been drinking and am unable to remember how to log into my machine, because I can't replicate the pattern and don't remember the password. After 15 minutes of concentration it comes back.

It is of course a much more refined approach; critically, there never is a stage at which you retain explicit knowledge of the password. With pseudo-implicit passwords (knowing how to type but not quite remembering what), recall is still possible -- either via explicit recall after sufficient deliberation, or via presentation of the input device.

(Neat trick, but reversible password encryption still seems like a massive flaw here...)

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#28

Post by chrisbroadfoot »

rytis wrote: post #21
bunderbunder wrote: post #17

Nitpick: This is not unbreakable crypto. This is more of a more secure key storage mechanism. Perhaps also a good defense against phishing attacks. And it's not unbreakable. For starters, this system absolutely requires that the passwords be stored in the clear.

What about encrypting your 'secret' password with normal password? So you get assigned this 30 characters password, which you learn. Then you use normal password (like 'password123' :) ) to encrypt that string. Then when you need to log on, you first type in you normal password to decrypt your 'secret' password, which is then used to authenticate you further. I know, sounds ridiculous, just thinking out loud. edit: y…

It sounds ridiculous for a reason. The weakest link in that chain is still the low-entropy password.

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#29

Post by brey »

DanBC wrote: post #20

> It also gives you deniability: If a judge or policeman orders you to hand over your password, you can plausibly say that you don’t actually know it The UK law requires that you make the encrypted data intelligible. Since you have encrypted data there's a pretty good chance you have the software to decrypt it. "They" don't want the password, they want the data. Failing to make the data intelligible (whether that's f…

> Mrs Ebastian's

more likely Mr Sebastian ... or was that intentional?

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#30

Post by Stefan_H »

gvsyn wrote: post #12

Isn't there a slight problem whereby someone denies knowing the password, you just put them in front of the keyboard and just ask them to type something? Due to it being a subconcious memory, it 'just happens'.

It wouldn't necessarily 'just happen'. From what I can glean, the idea is that if you are trying to play the game as well as possible, then the portion that you originally learned would be played better. You could certainly intentionally play the entire game poorly, thereby masking which portion is the password.
Post reply on HN