Unbreakable crypto: Store a 30-character password in your subconscious memory • Hacker News Board

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#41

Post by geon » Thu, Jul 19, 2012, 4:30 PM UTC

vecinu wrote: post #24

DanBC wrote: post #20

> It also gives you deniability: If a judge or policeman orders you to hand over your password, you can plausibly say that you don’t actually know it The UK law requires that you make the encrypted data intelligible. Since you have encrypted data there's a pretty good chance you have the software to decrypt it. "They" don't want the password, they want the data. Failing to make the data intelligible (whether that's f…

To add to that, the article doesn't make it clear why torture wouldn't work... One can torture you until you start attempting to input the password and recover it from your neurological pathways. A password is a password, it doesn't matter how you're storing it because it can be retrieved.

They would just threaten with torture unless you play the "passgame", just like they make you enter your password.

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#42

Post by Semaphor » Thu, Jul 19, 2012, 4:31 PM UTC

vecinu wrote: post #24

DanBC wrote: post #20

> It also gives you deniability: If a judge or policeman orders you to hand over your password, you can plausibly say that you don’t actually know it The UK law requires that you make the encrypted data intelligible. Since you have encrypted data there's a pretty good chance you have the software to decrypt it. "They" don't want the password, they want the data. Failing to make the data intelligible (whether that's f…

To add to that, the article doesn't make it clear why torture wouldn't work... One can torture you until you start attempting to input the password and recover it from your neurological pathways. A password is a password, it doesn't matter how you're storing it because it can be retrieved.

I think one advantage would be that they can force you to enter it… but only you. They can't get the password and kill you afterwards:)

Yeah, it's not described too well in the article but I think there are some users for this.

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#43

Post by Dove » Thu, Jul 19, 2012, 4:50 PM UTC

They had me until this part . . .

    Authentication requires that you play a round of the game —
    but this time, your 30-letter sequence is interspersed with 
    other random 30-letter sequences.

Which makes it sound to me like your password could be deduced from a single (failed) login attempt, and then reproduced after a session in the trainer.

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#44

Post by Dove » Thu, Jul 19, 2012, 4:59 PM UTC

Dove wrote: post #43

They had me until this part . . . Authentication requires that you play a round of the game — but this time, your 30-letter sequence is interspersed with other random 30-letter sequences. Which makes it sound to me like your password could be deduced from a single (failed) login attempt, and then reproduced after a session in the trainer.

Their discussion of that attack, from the paper itself:

    If the attacker is allowed multiple authentication 
    attempts — iterating the extraction and test phases, 
    alternating between the two — then the protocol may 
    become insecure.  The reason is that during an 
    authentication attempt the attacker sees the three 
    sequences k0; k1; k2 and could memorize one of them (30 
    symbols). He would then train ofﬂine on that sequence so 
    that at the next authentication attempt he would have a 
    1/3 chance in succeeding. If the attacker could memorize 
    all three sequences (90 symbols), he could ofﬂine 
    subject a trained user to all three sequences and 
    reliably determine which is the correct one and then 
    train himself on that sequence. He is then guaranteed 
    success at the next authentication trial.

    We note that this attack is non-trivial to pull off 
    since it can be difﬁcult for a human attacker to 
    memorize an entire sequence at the speed the game is 
    played.

. . . which isn't all that reassuring, given that if I were trying to break in using this technique, I wouldn't be memorizing, I'd be recording.

But it sounds like the system is designed to only give an attacker one trial (notionally opening a trap door under his feet if he fails even once), and it does seem much more secure in that context.

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#45

Post by mmagin » Thu, Jul 19, 2012, 5:06 PM UTC

peterwwillis wrote: post #19

This is basically the same method I use for laptop hard disk encryption. I don't remember the password, but I typed it so many times my fingers remember exactly the pattern to type. Kind of like playing a piano. Several times i've been drinking and am unable to remember how to log into my machine, because I can't replicate the pattern and don't remember the password. After 15 minutes of concentration it comes back.

I find that in this case, conscious concentration can actually make performance of the password sequence more difficult for me.

Also, I get into a stateful kind of memory where if I have to produce a password I normally produce at home while I'm at work, I produce the wrong password.

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#46

Post by Dove » Thu, Jul 19, 2012, 5:06 PM UTC

vecinu wrote: post #24

DanBC wrote: post #20

> It also gives you deniability: If a judge or policeman orders you to hand over your password, you can plausibly say that you don’t actually know it The UK law requires that you make the encrypted data intelligible. Since you have encrypted data there's a pretty good chance you have the software to decrypt it. "They" don't want the password, they want the data. Failing to make the data intelligible (whether that's f…

To add to that, the article doesn't make it clear why torture wouldn't work... One can torture you until you start attempting to input the password and recover it from your neurological pathways. A password is a password, it doesn't matter how you're storing it because it can be retrieved.

The problem with that is, they don't have the passphrase, so they can't put it into the game they show you. And you don't know it, so you can't enter it, even if you want to.

You can't produce the password. You can only subconsciously recognize it.

From the original paper:

   Further complicating the attacker’s life is the fact 
   that subjecting a person to many random SISL games may
   obliterate the learned sequence or cause the person to
   learn an incorrect sequence thereby making extraction
   impossible.

They can, at best, try to log in as you, record the sequence the terminal gives, have you (under duress!) play against that sequence in a remote location, determine the code, and train themselves. But that requires a login failure; this particular system is supposed to panic after even one login failure.

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#47

Post by bunderbunder » Thu, Jul 19, 2012, 5:15 PM UTC

anologwintermut wrote: post #35

bunderbunder wrote: post #17

Nitpick: This is not unbreakable crypto. This is more of a more secure key storage mechanism. Perhaps also a good defense against phishing attacks. And it's not unbreakable. For starters, this system absolutely requires that the passwords be stored in the clear.

It's not even that. YOu can't store a key with this divice because for the authentication game to work, the system has to have the password.

True.

So it's not unbreakable, nor is it crypto. I'm not sure if it's anything, really.

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#48

Post by ww520 » Thu, Jul 19, 2012, 5:31 PM UTC

It's not going to fly because it's not compatible with the corporate policy of changing password every 60 days.

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#49

Post by [deleted] » Thu, Jul 19, 2012, 5:42 PM UTC

Dove wrote: post #46

vecinu wrote: post #24

Earlier quoted context omitted.

To add to that, the article doesn't make it clear why torture wouldn't work... One can torture you until you start attempting to input the password and recover it from your neurological pathways. A password is a password, it doesn't matter how you're storing it because it can be retrieved.

The problem with that is, they don't have the passphrase, so they can't put it into the game they show you. And you don't know it, so you can't enter it, even if you want to. You can't produce the password. You can only subconsciously recognize it. From the original paper: Further complicating the attacker’s life is the fact that subjecting a person to many random SISL games may obliterate the learned sequence or cau…

[deleted]

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#50

Post by ralph » Thu, Jul 19, 2012, 5:47 PM UTC

peterwwillis wrote: post #19

This is basically the same method I use for laptop hard disk encryption. I don't remember the password, but I typed it so many times my fingers remember exactly the pattern to type. Kind of like playing a piano. Several times i've been drinking and am unable to remember how to log into my machine, because I can't replicate the pattern and don't remember the password. After 15 minutes of concentration it comes back.

I found I couldn't enter my password in unusual situations, e.g. holding the keyboard in one hand, typing with the other. I finally cottoned on that my fingers' muscle memory was typing the password consistently but it wasn't what I thought it was; it had been corrupted by similar N-grams in Unix commands from the moment I'd first entered it twice to passwd(1).