Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Unbreakable crypto: Store a 30-character password in your subconscious memory

extremetech.com

Post reply on HN
Print view View original

51–60 of 91 posts

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#51

Post by eli »

DanBC wrote: post #20

> It also gives you deniability: If a judge or policeman orders you to hand over your password, you can plausibly say that you don’t actually know it The UK law requires that you make the encrypted data intelligible. Since you have encrypted data there's a pretty good chance you have the software to decrypt it. "They" don't want the password, they want the data. Failing to make the data intelligible (whether that's f…

If you don't like the article, flag it and move on. Meta discussions (particularly about voting conspiracy theories) are not interesting.

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#52

Post by woobles »

While this does sound interesting from a psychological/neurological perspective, I feel bad for anyone who actually tries to implement a password system based on this. 38 bits of entropy is nothing, a standard password with 38 bits of entropy would take about 5 minutes to crack (assuming a GPU that can compute 1 billion hases/second). Nevermind that by the NIST specification for human-generated passwords, a 30 character string of alphas would be 45 bits of entropy. Also, as some others have pointed out, storing people's unique strings in the clear invalidates any strength this scheme could hope to achieve.

Source: http://en.wikipedia.org/wiki/Password_strength#Human-generat...

Conclusion: Interesting psychological experiment, not actually backed by any appreciable crypto knowledge.

Edit: disregard my NIST comment, someone linked the paper used to get the 38 bit figure, http://bojinov.org/professional/usenixsec2012-rubberhose.pdf.

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#53

Post by its_so_on »

This is a sensationalist headline, and this is not a strong password length. Based on the information in the article, this is really equivalent to a "strong" 5-character password - not very secure.

It's not "30-character unbreakable cryptography", you can crack it in minutes on your phone or desktop.

Technical details:

The article actually says that each 'character' you learn is one of only 6 possibilties - for only 2.5 bits per character and total entropy of 38 bits.

To see how woefully little entropy this is, if you code, try writing a program that counts to 2^38 - or on a 32-bit system go through the 4.2bn possible values of an integer 64 times. That's how many possible keys there are in a 38-bit password. It really just takes minutes - certainly far less than the 45 minutes the article says it takes to learn this password!

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#54

Post by exue »

On the topic of courts: There is a US court case in the 11th circuit where a federal judge, in fact, ruled that people are not required to give up their encryption passwords under the 5th amendment. It isn't a supreme court case however.

http://www.techrepublic.com/blog/tech-manager/personal-data-... "Last week in San Francisco, a federal court for the first time ruled that the Fifth Amendment of the U.S. Constitution — the right to not self-incriminate — protects against “forced decryption.” The judge, from the 11th Circuit in San Francisco, ruled that a Florida court violated a defendant’s rights when its Grand Jury gave him the choice to either reveal his TrueCrypt password or go to jail."

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#56

Post by woobles »

Robin_Message wrote: post #9
corin_ wrote: post #3

> If a judge or policeman orders you to hand over your password, you can plausibly say that you don’t actually know it Surely for this system to help in allowing you to plausibly say that, you'd have to reference this system (or equivalent) and demonstrate that it is indeed used for the authentication the police want access to. And in that case, surely the police could just say "in that case, please authenticate for…

Hopefully stress means that you won't be able to do it properly anyway, which means coercion is useless. The real problem is the device stores the password, so the real defence is the tamperproof-ness of the device, not whether you can be tricked or coerced into outputting the sequence.

I would personally prefer to have my password at any time, rather than have to get in the "zone" to authenticate into my computer.

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#57

Post by [deleted] »

peterwwillis wrote: post #19

This is basically the same method I use for laptop hard disk encryption. I don't remember the password, but I typed it so many times my fingers remember exactly the pattern to type. Kind of like playing a piano. Several times i've been drinking and am unable to remember how to log into my machine, because I can't replicate the pattern and don't remember the password. After 15 minutes of concentration it comes back.

[deleted]

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#58

Post by PotatoEngineer »

mrsebastian wrote: post #13
Robin_Message wrote: post #9

Earlier quoted context omitted.

Hopefully stress means that you won't be able to do it properly anyway, which means coercion is useless. The real problem is the device stores the password, so the real defence is the tamperproof-ness of the device, not whether you can be tricked or coerced into outputting the sequence.

Yeah, the research paper notes that they need to implement 'coercion detection'. From page 12: "Since our aim is to prevent users from effectively transmitting the ability to authenticate to others, there remains an attack where an adversary coerces a user to authenticate while they are under ad- versary control. It is possible to reduce the effective- ness of this technique if the system could detect if the user is…

What if you're running late to do something, or you are anxious to get access to the data behind the authentication for some other non-duress reason? Duress-detection will be tricky (but I look forward to them doing it!).

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#59

Post by dkokelley »

DanBC wrote: post #20

> It also gives you deniability: If a judge or policeman orders you to hand over your password, you can plausibly say that you don’t actually know it The UK law requires that you make the encrypted data intelligible. Since you have encrypted data there's a pretty good chance you have the software to decrypt it. "They" don't want the password, they want the data. Failing to make the data intelligible (whether that's f…

The deniability aspect is irrelevant. This is a method of authentication, not encryption. For the authentication to work, the system must know the password and present it to you, along with two other non-password foils. Then to access the system you must demonstrably show that you "score higher" on the trained sequence.

I'm not sure how one would apply this method to encryption.

Post reply on HN