A plastic card for easy to remember strong passwords • Hacker News Board

Re: A plastic card for easy to remember strong passwords

#21

Post by gravedave » Sat, Jan 10, 2015, 8:52 PM UTC

samspot wrote: post #18

Except it's not going to work, because of the bank who doesn't allow '(' as a special character, or the ticket website that requires at least 3 digits, or the financial firm who only allows 8 character passwords. As soon as you have a few sites with 'rogue' password policies, the system breaks down.

There are ways around it: using the code for the key directly north-west of the problematic character, and if that's a bad character go further, maybe wrap around, or try to follow through the problem character (a/& -> &/| -> |/f, thus f would be the code for a) etc.

As for remembering which sites have what restrictions, I can keep that stuff in my head (looking at you Microsoft), but I guess you may have more accounts than me. Then again, when a password fails, then all you'd have to do is retry with a safer version (and maybe only have two password kinds, for convenience - full-blown char support, and minimalistic lowercase-letters only, so you'd only have to retry a single time after the first failed login).

Personally, my biggest problem with this card is that it doesn't provide enough value.

Re: A plastic card for easy to remember strong passwords

#22

Post by [deleted] » Sat, Jan 10, 2015, 8:55 PM UTC

hyperbovine wrote: post #16

agwa wrote: post #7

This is a substitution cipher and it's not very secure. Consider what we can do if we compromise the Amazon password that's given as an example on the website: sh(/J3HqAfQsu..u.rqf Since the password came from Amazon, we know that the last 6 characters are "Amazon," which tells us that: . = A u = M r = Z q = O f = N Now we can start attacking the codeword, which are the characters between the 8-character "space bar c…

This sort of objection is raised whenever basically any mechanism for remembering strong passwords is presented. Much like many results in computational complexity, worst-case results are not necessarily indicative of real-world utility. To wit, in the scenario you outlined the attacker must a) know beforehand that the target was using this device; b) know beforehand that the inserted middle portion was vulnerable to…

[deleted]

Re: A plastic card for easy to remember strong passwords

#23

Post by w8rbt » Sat, Jan 10, 2015, 9:12 PM UTC

These others have been around for ages. And, they are free.

http://www.passwordcard.org/en

Re: A plastic card for easy to remember strong passwords

#24

Post by scenefinale » Sat, Jan 10, 2015, 9:15 PM UTC

I use dvorak, you insensitive clod!

Re: A plastic card for easy to remember strong passwords

#25

Post by raarky » Sat, Jan 10, 2015, 9:17 PM UTC

my current "scheme" for creating new passwords is to simply write a long, unique passphrase with the idea that I will only remember it for the short time needed to log in after registration.

If I need to log in sometime in the future, I simply reset the password.

Re: A plastic card for easy to remember strong passwords

#26

Post by eterm » Sat, Jan 10, 2015, 9:18 PM UTC

qycard wrote: post #3

We've got you covered: https://www.qwertycards.com/frequent_questions.html#lost_sto... Every card ships with a letter showing the only unique copy of the card.

Error: EMFILE, open '/home/qwerty/live/views/frequent_questions.html'

Re: A plastic card for easy to remember strong passwords

#27

Post by theophrastus » Sat, Jan 10, 2015, 9:20 PM UTC

Some of us have even made do with variations on the "Old School Tabula recta": http://lifehacker.com/5715794/how-to-write-down-and-encrypt-...

"If I'm logging into Amazon I'll find the intersection of column M and row A (the second and third letters of Amazon) and then read off diagonally 16 characters."

Re: A plastic card for easy to remember strong passwords

#28

Post by lifeisstillgood » Sat, Jan 10, 2015, 9:28 PM UTC

Sadly this is still a fail - I have found numerous sites whose fatuous restrictions on what are or are not legal entries include banning punctuation, never ending in a letter and more.

This seems an amusing and useful idea to making passwords - it's usability seems longer lived than my previous (personal) attempts (md5 hashing passwords and domain names).

In the end I need a trustable approach to storing encrypted data on my iphone - I suspect i have missed one. Any ideas?

Re: A plastic card for easy to remember strong passwords

#29

Post by __david__ » Sat, Jan 10, 2015, 9:28 PM UTC

sarciszewski wrote: post #20

chronial wrote: post #12

Earlier quoted context omitted.

Just use random words. Memorable passwords don’t have to be weak. Five random common english words are already very strong. Just make sure you don’t pick the words by hand.

https://github.com/resonantcore/lib/blob/master/js/diceware/... https://github.com/resonantcore/lib/blob/master/demo/dicewar... Run this locally, e.g. dw = new Diceware(); dw.load("https://raw.githubusercontent.com/resonantcore/lib/master/js/diceware/diceware.wordlist.asc", function() { console.log("Diceware loaded!"); }); console.log(dw.getWords(8).join(' '));

If you're on linux you can usually just do:

    shuf -n 5 /usr/share/dict/words

On Mac OS X you need coreutils for shuf, which you can get from brew (it's called gshuf once installed).

Re: A plastic card for easy to remember strong passwords

#30

Post by curun1r » Sat, Jan 10, 2015, 9:34 PM UTC

hyperbovine wrote: post #16

agwa wrote: post #7

This is a substitution cipher and it's not very secure. Consider what we can do if we compromise the Amazon password that's given as an example on the website: sh(/J3HqAfQsu..u.rqf Since the password came from Amazon, we know that the last 6 characters are "Amazon," which tells us that: . = A u = M r = Z q = O f = N Now we can start attacking the codeword, which are the characters between the 8-character "space bar c…

This sort of objection is raised whenever basically any mechanism for remembering strong passwords is presented. Much like many results in computational complexity, worst-case results are not necessarily indicative of real-world utility. To wit, in the scenario you outlined the attacker must a) know beforehand that the target was using this device; b) know beforehand that the inserted middle portion was vulnerable to…

> This sort of objection is raised whenever basically any mechanism for remembering strong passwords is presented.

Yes, because we've basically realized that memorizing passwords isn't a workable solution. We should be recommending password managers that generate/store strong passwords and MFA for any account that needs to be secure. That these password generators themselves can now be unlocked using both memorized information and biometrics (TouchID and such) makes them all the more secure.

Moreover, this is the only solution that's capable of dealing with all the asinine password requirements that get imposed on users...solutions like this card fail hard when the password requirements prohibit certain characters and/or other characteristics of these passwords (repeated characters, length, etc.) Until the world gets together and standardizes what constitutes a secure password, memorized passwords will always be a flawed solution.