Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chroma-Hash: a sexy, non-reversible, live visualization of password field input

mattt.github.com

Post reply on HN
Print view View original

51–60 of 70 posts

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#51

Post by zackattack »

calambrac wrote: post #32
heroin wrote: post #16

I do not have time to read the code. But if the colors are generated using one way hash, this would be great to have on every site. Using of colors can be replaced by showing the hash in plain text. Everybody would remember their password colors, and typos in password would be history.

Thanks gods we finally have a security-compromising solution to the world-stopping problem of typos in passwords.

This has been a big deal around the net as well as HN recently. Your sarcasm is both inappropriate as well as indicative of ignorance. Parent should be upvoted despite the superfluous comment of "didn't have time to read the source", because at first, I didn't perceive why this was useful.

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#52

Post by pohl »

calambrac wrote: post #42
nollidge wrote: post #40

Earlier quoted context omitted.

It's not very well presented in the demo (there's no need for the Confirm inputbox), but the point is not for password creation, but for login. From the author's github page ( http://github.com/mattt/Chroma-Hash/tree/master ): Chroma-Hash displays a series of colored bars at the end of field inputs so you can instantly see if your password is right... Your password will display the same sequence each time, so you can…

Wow, that changes everything. So now I have a security-compromising solution to the problem I currently solve by using a keychain or knowing how to type, and all I have to do is remember my 3 magic colors and figure out if that shade of blue is the right one.

You still have to remember your password. The colors alone will not get you in. Rather, they merely help you know whether you mistyped it before you submit.

I'm not arguing the merits of this concept; I'm just clarifying its intent. There has been a recent wave of design fury over the HTML password input field (the one that obscures keystrokes with dots) Sites with a bajillion users have become concerned about the small percentage of users who get frustrated by failed login attempts and leave. Wanting to avoid turning users away, they have started to experiment with ways to make the field more usable.

Perhaps user disengagement resulting from input type="password", for some, translates to a measurable amount of money. Or maybe it's just a matter of trying to reduce support costs from the volume of "I can't log in" calls.

Either way, it's an interesting problem for UI design specialists.

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#54

Post by madcaptenor »

DTrejo wrote: post #6

Now for some fun Douglas Hofstadter self-reference. Challenge: Can someone find a password that describes the colors it makes? e.g. "redgreenblue" shows red, green, and blue

"blueorangepink" works.

I found it by typing in a random password, then using as a password the colors from that password, and repeating until I got the self-referential password. I can't think of a good reason why this should work, though. And you might argue that the third color there is really purple, not pink.

New question: lots of countries have flags which consist of three stripes. Is there a country whose chromahash is its flag?

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#55

Post by calambrac »

zackattack wrote: post #51
calambrac wrote: post #32

Earlier quoted context omitted.

Thanks gods we finally have a security-compromising solution to the world-stopping problem of typos in passwords.

This has been a big deal around the net as well as HN recently. Your sarcasm is both inappropriate as well as indicative of ignorance. Parent should be upvoted despite the superfluous comment of "didn't have time to read the source", because at first, I didn't perceive why this was useful.

Yeah, ignorance. I read the Jakob Nielsen article and all the responses, don't worry. At least with his proposal, you got a checkbox to enable the feature, and you knew explicitly without having to understand how hashes work that you were giving away your password if you typed it in view of other people.

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#56

Post by calambrac »

liquidben wrote: post #50
chaosmachine wrote: post #25

Earlier quoted context omitted.

Because you can see the color code at each step, it's easy to compare results very quickly, even by hand. Did I get letter 1 right? Ok, move on to letter two, try each key until the colors match the recording. Do this for each step. At most, you have to try about 64 key presses to crack each letter. Also, because each step is only 1 character different, it's very unlikely that you will get collisions, even with a tru…

It strikes me that this reduces password cracking to a game of Mastermind. Amusement aside, it also allows a cracking attempt to be done without running up against server authentication. Even if the same series of color patterns can occur for multiple passwords, the quantity of attempted server authentications is greatly reduced.

It's actually easier than Mastermind, you only have to guess one character at a time.

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#57

Post by calambrac »

pohl wrote: post #52
calambrac wrote: post #42

Earlier quoted context omitted.

Wow, that changes everything. So now I have a security-compromising solution to the problem I currently solve by using a keychain or knowing how to type, and all I have to do is remember my 3 magic colors and figure out if that shade of blue is the right one.

You still have to remember your password. The colors alone will not get you in. Rather, they merely help you know whether you mistyped it before you submit. I'm not arguing the merits of this concept; I'm just clarifying its intent. There has been a recent wave of design fury over the HTML password input field (the one that obscures keystrokes with dots) Sites with a bajillion users have become concerned about the sm…

There's been a recent wave of design fury because Jakob Nielsen wrote his article on unmasking the password field and the bike-shedders of the world decided they had to weigh in with their 'improvements', not because this is any kind of newly urgent problem.

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#59

Post by dbz »

calambrac wrote: post #34
dbz wrote: post #2

I really like that- it would be nice to see that become popular for inputting passwords. It's a nice way to check to see if your confirmed password is the actual password; Furthermore, it might even help one generate more complex passwords because he or she might want a certain set of colors.

Think on that statement for a moment. If you wanted a particular set of colors for your password, and then you could turn around and actually come up with that password... see the problem? Hint: 'non-reversible'. This idea, in its current form, sucks. It's not as bad as what you're suggesting, but it comes close - as has been pointed out by many others, if you can watch the colors change with each keystroke, you can…

Second thought- this is an awful idea. I didn't think of it in that way, and it does indeed seem like a security risk. Your password might as well be the three colors.

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#60

Post by michaelfairley »

What if this only displayed one color instead? It would be much more secure against snooping, but will still provide a large portion of the benefit. Sure, the number of false collisions would go up a ton, but the odds of trying to type the same thing and accidentally typing do different things that collide would be relatively small.
Post reply on HN