Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Unbreakable crypto: Store a 30-character password in your subconscious memory

extremetech.com

Post reply on HN
Print view View original

71–80 of 91 posts

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#71

Post by gliese1337 »

Semaphor wrote: post #42
vecinu wrote: post #24

Earlier quoted context omitted.

To add to that, the article doesn't make it clear why torture wouldn't work... One can torture you until you start attempting to input the password and recover it from your neurological pathways. A password is a password, it doesn't matter how you're storing it because it can be retrieved.

I think one advantage would be that they can force you to enter it… but only you. They can't get the password and kill you afterwards:) Yeah, it's not described too well in the article but I think there are some users for this.

Have you play it and record your performance. Now they can spoof the game with a computer player that intentionally mimics your performance.

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#73

Post by gojomo »

Some critics are getting hung up on the hard-to-understand details, or zeroing in on a few stretch claims about potential usefulness in certain situations. There is still novelty and innovation here. It is a different way to train, prompt, and evaluate authentication attempts.

Even if not perfectly resistant to all kinds of coercion, or ideally strong in an information-theoretic sense, its weaknesses in various dimensions are different than more traditional systems. It is thus suggestive of other potential directions in the design space, leveraging other aspects of human memory/behavior.

It bears some similarity to systems which add the timing of a person's typing as an added authenticating factor.

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#74

Post by napillo »

woobles wrote: post #56
Robin_Message wrote: post #9

Earlier quoted context omitted.

Hopefully stress means that you won't be able to do it properly anyway, which means coercion is useless. The real problem is the device stores the password, so the real defence is the tamperproof-ness of the device, not whether you can be tricked or coerced into outputting the sequence.

I would personally prefer to have my password at any time, rather than have to get in the "zone" to authenticate into my computer.

Yeah, I imagine if you had a stroke or perhaps are suffering muscle fatigue you wouldn't do very good at all. The security provided isn't better than a 9 character all lowercase password.

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#75

Post by mikeash »

Dove wrote: post #46
vecinu wrote: post #24

Earlier quoted context omitted.

To add to that, the article doesn't make it clear why torture wouldn't work... One can torture you until you start attempting to input the password and recover it from your neurological pathways. A password is a password, it doesn't matter how you're storing it because it can be retrieved.

The problem with that is, they don't have the passphrase, so they can't put it into the game they show you. And you don't know it, so you can't enter it, even if you want to. You can't produce the password. You can only subconsciously recognize it. From the original paper: Further complicating the attacker’s life is the fact that subjecting a person to many random SISL games may obliterate the learned sequence or cau…

I don't understand. Why can't they just hand you the terminal and say, "log in or we'll shoot you"? Why the roundabout process with recording the sequence and having a failed login and all that?

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#76

Post by duaneb »

EvilTerran wrote: post #69
peterwwillis wrote: post #26

Earlier quoted context omitted.

Yeah, I find speed is important too. The quicker you can type it, the easier it is to recall. Another thing, if I slow down I notice i'm sort of humming parts of the pattern in my head, as if each character held a sort of audible weight that indicates where my fingers should go next... again, kind of like playing an instrument. Yet I can't play anything. Weird.

Sounds like that could be a sort of synaesthesia: http://en.wikipedia.org/wiki/Synaesthesia

I've been wondering for a while where the boundary for being diagnosed with synaesthesia is - nearly everyone I know has some sort of synaesthesia, even if it's only associating numbers with colors. Yet, it's no where near the viewing-numbers-as-landscapes of Daniel Tammet's Born on a Blue Day or Nabokov's gift with words.

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#77

Post by [deleted] »

mikeash wrote: post #75
Dove wrote: post #46

Earlier quoted context omitted.

The problem with that is, they don't have the passphrase, so they can't put it into the game they show you. And you don't know it, so you can't enter it, even if you want to. You can't produce the password. You can only subconsciously recognize it. From the original paper: Further complicating the attacker’s life is the fact that subjecting a person to many random SISL games may obliterate the learned sequence or cau…

I don't understand. Why can't they just hand you the terminal and say, "log in or we'll shoot you"? Why the roundabout process with recording the sequence and having a failed login and all that?

[deleted]

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#78

Post by DanBC »

mikeash wrote: post #75
Dove wrote: post #46

Earlier quoted context omitted.

The problem with that is, they don't have the passphrase, so they can't put it into the game they show you. And you don't know it, so you can't enter it, even if you want to. You can't produce the password. You can only subconsciously recognize it. From the original paper: Further complicating the attacker’s life is the fact that subjecting a person to many random SISL games may obliterate the learned sequence or cau…

I don't understand. Why can't they just hand you the terminal and say, "log in or we'll shoot you"? Why the roundabout process with recording the sequence and having a failed login and all that?

Doing something with a gun at your head is, I imagine, pretty hard. Imagine something you do with muscle memory every day - maybe typing fast or editor keyboard shortcuts or somesuch. Now deprive you of sleep, and food, and make you anxious, and then have someone with a gun at your head. Are you still going to be typing as fast? With the same error rate? Are you going to be making the same keyboard shortcuts?

Having said all that, I agree it's a valid risk.

But it's extreme. Other risks are interesting to look at.

The game produces one stream of output mixed from one unique (to each player) log in sequence and some random data. So recording many streams would seem to make the real sequence available, and now you just need to simulate the player response to that input. Analysis of sound is an established technology now, having had considerable investment and research because of its military technology. Recording the sound of keystrokes (of type writers, some printers, computer keyboards) can produce accurate transcripts of what has been written.

Having said all that, I am glad that there are people researching this stuff. It's a bizarrely under-researched gap in security.

And the underlying idea seems reasonable enough. I have a few passwords that I can enter if I'm in front of my keyboard, but give me a different keyboard and I'd struggle.

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#79

Post by EvilTerran »

duaneb wrote: post #76
EvilTerran wrote: post #69

Earlier quoted context omitted.

Sounds like that could be a sort of synaesthesia: http://en.wikipedia.org/wiki/Synaesthesia

I've been wondering for a while where the boundary for being diagnosed with synaesthesia is - nearly everyone I know has some sort of synaesthesia, even if it's only associating numbers with colors. Yet, it's no where near the viewing-numbers-as-landscapes of Daniel Tammet's Born on a Blue Day or Nabokov's gift with words.

I suspect almost everyone has a little synaesthesia, just like almost everyone has a little depression, a little anxiety, a little Borderline Personality, a little schizophrenia...

I guess it's only worth giving your mental quirks a name if, say, they're 2σ above norm. I dunno, ask your doctor (or statistician :P).

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#80

Post by dhx »

woobles wrote: post #52

While this does sound interesting from a psychological/neurological perspective, I feel bad for anyone who actually tries to implement a password system based on this. 38 bits of entropy is nothing, a standard password with 38 bits of entropy would take about 5 minutes to crack (assuming a GPU that can compute 1 billion hases/second). Nevermind that by the NIST specification for human-generated passwords, a 30 charac…

38 bits of entropy for authentication may be plentiful if other security controls are put in place. Bank card security would not be noticeably increased by having 6 or 8 digit PINs instead of 4 digit PINs. The risk is mitigated by account lockout (swallowing cards), surveillance, damage limitation (daily withdrawal limits) and similar measures. The system proposed in this paper could be a valid mitigation against authentication risks in very specific circumstances.

A better argument against this system would be one that addresses human usability and unnecessary cost/complexity.

Post reply on HN