Chroma-Hash: a sexy, non-reversible, live visualization of password field input • Hacker News Board

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#41

Post by amanfredi » Wed, Jul 29, 2009, 1:17 PM UTC

amanfredi wrote: post #38

Robin_Message wrote: post #31

You could use a nonce when you have two password boxes, so that the two boxes match, but the hash cannot be reversed by someone who just sees the sequence. However, this would mean the hash is different each time, so it would be no good for confirming your password is correct before you login. For the registration case, just show a tick when the fields are equal. Or just wait for the round-trip, it's not that bad. Fr…

Someone at my company looked at password requests last week, and it looks like about 50% of login attempts fail.

This could be due to a lot of trash submissions. I just checked and our web analytics put the number closer to 10%.

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#42

Post by calambrac » Wed, Jul 29, 2009, 1:19 PM UTC

nollidge wrote: post #40

calambrac wrote: post #35

Earlier quoted context omitted.

Um, what? The old method is a warning symbol or a checkmark to ensure the password fields match. Replacing that nice, intuitive, more accessible feature with this would be, excuse me, retarded. And it's not just colorblind people who would suffer. Do you really want to spend brain cycles trying to figure out if you're looking at the same shade of blue?

It's not very well presented in the demo (there's no need for the Confirm inputbox), but the point is not for password creation, but for login. From the author's github page ( http://github.com/mattt/Chroma-Hash/tree/master ): Chroma-Hash displays a series of colored bars at the end of field inputs so you can instantly see if your password is right... Your password will display the same sequence each time, so you can…

Wow, that changes everything. So now I have a security-compromising solution to the problem I currently solve by using a keychain or knowing how to type, and all I have to do is remember my 3 magic colors and figure out if that shade of blue is the right one.

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#43

Post by [deleted] » Wed, Jul 29, 2009, 1:22 PM UTC

amanfredi wrote: post #38

Robin_Message wrote: post #31

You could use a nonce when you have two password boxes, so that the two boxes match, but the hash cannot be reversed by someone who just sees the sequence. However, this would mean the hash is different each time, so it would be no good for confirming your password is correct before you login. For the registration case, just show a tick when the fields are equal. Or just wait for the round-trip, it's not that bad. Fr…

Someone at my company looked at password requests last week, and it looks like about 50% of login attempts fail.

[deleted]

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#44

Post by ja27 » Wed, Jul 29, 2009, 1:36 PM UTC

chaosmachine wrote: post #11

This is pretty, but non-reversible it isn't. The colors update with every keystroke, making it easy to determine letter by letter, which keys are being pressed. This is a significant hole in many situations (screencasts, recorded presentations, or anywhere someone can point a camera at your screen). Simple fix: Wait for 300ms of keyboard inactivity before computing the colors. This way you only get the colors when th…

This is similar to the attack on Lotus Notes' hieroglyphics:

http://www.securityfocus.com/bid/4324/discuss

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#45

Post by catch23 » Wed, Jul 29, 2009, 1:38 PM UTC

Pistos2 wrote: post #8

jhdevos wrote: post #5

What an incredibly good idea! It would probably not be too difficult to build this as a firefox plugin, so that all password fields (or all blanked out input fields) on the web will automatically get this feature... Anyone? :-)

It seems to rely on jQuery, so a Firefox plugin, greasemonkey script, or Opera userjs would need to bundle or src jQuery. Whether or not that is okay I will leave on the table for debate and discussion. :)

you can always use firefox javascript code modules to completely sandbox your javascript code, that way your jquery version won't conflict with whatever happens to be on the page. Highly useful especially if you're modifying String.prototype or Array.prototype.

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#46

Post by diiq » Wed, Jul 29, 2009, 1:56 PM UTC

It's certainly a shiny way of dealing with hiding password from over-the-shoulder leaks while still allowing for verification; I agree with chaosmachine, it is very worth only showing the final result, and not the intermediary steps, even though that wouldn't be as pretty.

I'd love it if my keyring showed me the color combo for my password at each site --- then if my computer is stolen my passwords don't go with it; but when I get to a site I haven't logged in to for a few months, I don't have to try ten different passwords to remember which one I used.

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#47

Post by slmbrhrt » Wed, Jul 29, 2009, 2:09 PM UTC

Why not try hashing on the result of some operation (xor would be bad because, well, you know) on the password and the challenge together, and not displaying the hash until the password and challenge are the same length?

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#48

Post by apinstein » Wed, Jul 29, 2009, 2:21 PM UTC

I'm a developer and I can't even guess what the visualization "means" in under 10 seconds. I don't get the point of it much less see any practical utility for this...

Neat css trick, though!

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#49

Post by matttthompson » Wed, Jul 29, 2009, 2:29 PM UTC

Thanks for all of your feedback so far! I just posted a bit of explanation and a response on my blog: http://mattt.me/2009/07/chroma-hash-a-belated-introduction/

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#50

Post by liquidben » Wed, Jul 29, 2009, 2:41 PM UTC

chaosmachine wrote: post #25

Torn wrote: post #22

Earlier quoted context omitted.

I don't see how this follows -- the colours are changing with each keypress (just as an md5 digest would change if you added a letter to the message) but surely you cannot know the key pressed without brute-forcing / breaking the hash, which is computationally impractical? He's also scraping the hash for a run of 6 hex characters, so surely there's quite a few colour collisions for different hashes, making it even ha…

Because you can see the color code at each step, it's easy to compare results very quickly, even by hand. Did I get letter 1 right? Ok, move on to letter two, try each key until the colors match the recording. Do this for each step. At most, you have to try about 64 key presses to crack each letter. Also, because each step is only 1 character different, it's very unlikely that you will get collisions, even with a tru…

It strikes me that this reduces password cracking to a game of Mastermind.

Amusement aside, it also allows a cracking attempt to be done without running up against server authentication. Even if the same series of color patterns can occur for multiple passwords, the quantity of attempted server authentications is greatly reduced.