Does this mean the system will have to store your password as plain text? I more trust myself to choose a secure password than any service to keep the plain text password secured.
Unbreakable crypto: Store a 30-character password in your subconscious memory
81–90 of 91 posts
Re: Unbreakable crypto: Store a 30-character password in your subconscious memory
#82Earlier quoted context omitted.
I think one advantage would be that they can force you to enter it… but only you. They can't get the password and kill you afterwards:) Yeah, it's not described too well in the article but I think there are some users for this.
Have you play it and record your performance. Now they can spoof the game with a computer player that intentionally mimics your performance.
Simple answer there.... just have the system automatically lock the account if you statistically miss the password, just at it statistacally allows you in if you play properly.
Or maybe it's only accessible from secure locations - you don't go this much trouble to secure day to day stuff.
It's not unbreakable, but the idea that you're letting someone in by statistical analysis of their conditioned response to a game, including their mistakes is clever - no reason you couldn't lock them out or use other security measures by failure to meet that response.
Re: Unbreakable crypto: Store a 30-character password in your subconscious memory
#83This is a sensationalist headline, and this is not a strong password length. Based on the information in the article, this is really equivalent to a "strong" 5-character password - not very secure. It's not "30-character unbreakable cryptography", you can crack it in minutes on your phone or desktop. Technical details: The article actually says that each 'character' you learn is one of only 6 possibilties - for only…
just want to point out that the "entropy of 38 bits" comes from the researchers - the first character has entropy of 2.5 bits but not all 30-length 'passwords' are valid, only a very small number of them, according to the researchers.
38-bit keys/passwords are not secure by any stretch of the imagination, no matter how they are chosen. (i.e. even the best random number generator on Earth doesn't help if you can just try every possibility in minutes.)
Re: Unbreakable crypto: Store a 30-character password in your subconscious memory
#84Earlier quoted context omitted.
The problem with that is, they don't have the passphrase, so they can't put it into the game they show you. And you don't know it, so you can't enter it, even if you want to. You can't produce the password. You can only subconsciously recognize it. From the original paper: Further complicating the attacker’s life is the fact that subjecting a person to many random SISL games may obliterate the learned sequence or cau…
I don't understand. Why can't they just hand you the terminal and say, "log in or we'll shoot you"? Why the roundabout process with recording the sequence and having a failed login and all that?
Sorry for the late reply. This system isn't designed to be used on a terminal over the net. From the original paper:
The proposed system is designed to be
used as a local password mechanism requiring physical
presence. That is, we consider authentication at the
entrance to a secure location where a guard can ensure
that a real person is taking the test without the aid of
any electronics.
We note that physical presence is necessary in
authentication systems designed to resist coercion
attacks. If the system supported remote authentication
then an attacker could coerce a trained user to
authenticate to a remote server and then hijack the
session.
Re: Unbreakable crypto: Store a 30-character password in your subconscious memory
#85Earlier quoted context omitted.
Have you play it and record your performance. Now they can spoof the game with a computer player that intentionally mimics your performance.
Simple answer there.... just have the system automatically lock the account if you statistically miss the password, just at it statistacally allows you in if you play properly. Or maybe it's only accessible from secure locations - you don't go this much trouble to secure day to day stuff. It's not unbreakable, but the idea that you're letting someone in by statistical analysis of their conditioned response to a game,…
My first thought was "how would locking the account if you miss it help, if you don't know how to miss it?"
However, if you're in a situation where someone is trying to forcibly extract access from you, there's s good chance that a stressed state of mind would be reflected in variations in how you play, which could be noticed by the system.
Even if it's limited to a specific secured location, though, you still have to worry about the possibility of keyloggers, which could be used to mount a reply attack without you ever having to know.
Re: Unbreakable crypto: Store a 30-character password in your subconscious memory
#86Earlier quoted context omitted.
I don't understand. Why can't they just hand you the terminal and say, "log in or we'll shoot you"? Why the roundabout process with recording the sequence and having a failed login and all that?
Sorry for the late reply. This system isn't designed to be used on a terminal over the net. From the original paper: The proposed system is designed to be used as a local password mechanism requiring physical presence. That is, we consider authentication at the entrance to a secure location where a guard can ensure that a real person is taking the test without the aid of any electronics. And . . . We note that physic…
If the attacker has long-term control (e.g. hostage, blackmail, etc.) this is useless.
If the attacker does not, you'll simply ask for help as soon as you're there.
If the attacker wants to impersonate you, a photo check will work as well and is much faster
The authors and the news coverage claim this offers some sort of rubber-hose defense but the only scenarios described are either contrived or duplicate more proven techniques (e.g. duress codes, biometrics)
Re: Unbreakable crypto: Store a 30-character password in your subconscious memory
#87So all the clever people have concluded that this system is useless, because you can pull a gun on someone and force them to play the game. Not to mention: it's not even that much entropy! So let's all just forget about it move on with our lives, right? No. Of course not. What this system provides is a unique -extra- method of authentication. I really doubt this is meant for putting this on your laptop in place of a…
The authors are claiming that it helps against duress but the system as described only does so in the most limited theoretical scenario where the attacker and defender both have significant, contrived restrictions. There's a reason why you remember those retina scanner tricks from movies: in the real world, security is about protocols and those tricks would fail in any realistic scenario short of, say, aliens with body-sculpting nanobots.
As a trivial example: this system assumes a single attempt in a guarded facility. What benefit does this offer over a duress password which our poor hostage provides knowing that it will trigger a full security response and locking out of their access? For that matter, why not have the same guard who looks for tricks check your face against the employee database?
Re: Unbreakable crypto: Store a 30-character password in your subconscious memory
#88Some critics are getting hung up on the hard-to-understand details, or zeroing in on a few stretch claims about potential usefulness in certain situations. There is still novelty and innovation here. It is a different way to train, prompt, and evaluate authentication attempts. Even if not perfectly resistant to all kinds of coercion, or ideally strong in an information-theoretic sense, its weaknesses in various dimen…
People are reacting to the authors overselling their work, as amplified by extremetech: they're claiming this as hardening against rubber-hose cryptoanalysis, which is simply untrue. Their paper actually describes a system which actually has nothing to with cryptography - it's authentication - and has failure modes which are identical to password authentication, except where it imposes significant new barriers to practical application.
If they'd published it as a minor curiosity suggesting an area for future research there'd be far less backlash.
Re: Unbreakable crypto: Store a 30-character password in your subconscious memory
#89While this does sound interesting from a psychological/neurological perspective, I feel bad for anyone who actually tries to implement a password system based on this. 38 bits of entropy is nothing, a standard password with 38 bits of entropy would take about 5 minutes to crack (assuming a GPU that can compute 1 billion hases/second). Nevermind that by the NIST specification for human-generated passwords, a 30 charac…
38 bits of entropy for authentication may be plentiful if other security controls are put in place. Bank card security would not be noticeably increased by having 6 or 8 digit PINs instead of 4 digit PINs. The risk is mitigated by account lockout (swallowing cards), surveillance, damage limitation (daily withdrawal limits) and similar measures. The system proposed in this paper could be a valid mitigation against aut…
Fair enough. My numbers are of course based on an unsalted hash which has been stolen from a db or otherwise obtained by an attacker.
Further arguments include high overhead for learning (not to mention changing passwords) a given password, storage of passwords, and the idea that your password isn't summonable on demand.
Re: Unbreakable crypto: Store a 30-character password in your subconscious memory
#90Earlier quoted context omitted.
The problem with that is, they don't have the passphrase, so they can't put it into the game they show you. And you don't know it, so you can't enter it, even if you want to. You can't produce the password. You can only subconsciously recognize it. From the original paper: Further complicating the attacker’s life is the fact that subjecting a person to many random SISL games may obliterate the learned sequence or cau…
I don't understand. Why can't they just hand you the terminal and say, "log in or we'll shoot you"? Why the roundabout process with recording the sequence and having a failed login and all that?
[deleted]