I just registered dvorakcards.com and colemakcards.com.
Thanks,
A plastic card for easy to remember strong passwords
71–80 of 110 posts
Re: A plastic card for easy to remember strong passwords
#72Many sites where I perform sensitive transactions require me to periodically change my password (banks, brokerage, etc.)
The Shannon entropy of the impossible to remember example password is 3.68418, which is not much better than the xkcd "easy for a human to remember" password 3.36386
Re: A plastic card for easy to remember strong passwords
#73This is a substitution cipher and it's not very secure. Consider what we can do if we compromise the Amazon password that's given as an example on the website: sh(/J3HqAfQsu..u.rqf Since the password came from Amazon, we know that the last 6 characters are "Amazon," which tells us that: . = A u = M r = Z q = O f = N Now we can start attacking the codeword, which are the characters between the 8-character "space bar c…
You are making a rather critical mistake; you are not realizing that not only are the character associations variable, but so is the "space bar code", which will be unique for each card.
The point being that, although not impossible, it is far more complicated to break the code than you describe here.
You are also assuming that everyone will use the full name of the site, e.g., AMAZON, and not simply AZ or AMZN or AMA. For example, I may use YC or YCOMB or YCOMBINATOR for this site, which would also increase the combination exponent..
Re: A plastic card for easy to remember strong passwords
#74This is a substitution cipher and it's not very secure. Consider what we can do if we compromise the Amazon password that's given as an example on the website: sh(/J3HqAfQsu..u.rqf Since the password came from Amazon, we know that the last 6 characters are "Amazon," which tells us that: . = A u = M r = Z q = O f = N Now we can start attacking the codeword, which are the characters between the 8-character "space bar c…
You are making a rather critical mistake; you are not realizing that not only are the character associations variable, but so is the "space bar code", which will be unique for each card. The point being that, although not impossible, it is far more complicated to break the code than you describe here. You are also assuming that everyone will use the full name of the site, e.g., AMAZON, and not simply AZ or AMZN or AM…
> You are making a rather critical mistake; you are not realizing that not only are the character associations variable, but so is the "space bar code", which will be unique for each card.
I don't know what you mean by "variable" "character associations," but note that my analysis doesn't depend on the space bar code at all, except assuming that it's the first eight characters, which the site's FAQ guarantees. Otherwise my analysis completely ignores it.
> You are also assuming that everyone will use the full name of the site, e.g., AMAZON, and not simply AZ or AMZN or AMA. For example, I may use YC or YCOMB or YCOMBINATOR for this site, which would also increase the combination exponent..
True, but there are only a handful of logical choices for any given site.
In any case, this is just haggling - the point is that attacks like this shouldn't be possible at all for something claiming to generate "very strong passwords."
Re: A plastic card for easy to remember strong passwords
#75Earlier quoted context omitted.
What is the point of decoding this back into the user's original "ENIGMA" and "AMAZON" strings? In this case, "sh(/J3HqAfQsu..u.rqf" is the user's password. If you have that, there is nothing to crack. Edit: I see "Combine with another compromised password, and we're coming dangerously close to being able to generate a password for any arbitrary website.", which means that if an attacker could obtain a couple of thes…
> If you have that, there is nothing to crack. Alice is a system administrator of xyz.com. She has access to the password that Bob uses on xyz.com. By reverse engineering Bob's password on xyz.com, Alice can then attack Bob's account on pqr.com.
Unless you use pqr, or cut space in half. Then that entire design goes out the window.
Re: A plastic card for easy to remember strong passwords
#76Brilliant! Until you lose your wallet. Much like lastpass and other password management software, you're putting all your eggs in one basket, and having faith it won't fail. Passwords are a shitty idea people. We need a better system.
You could take a photo or photocopy of that and leave it in a secure place.
Boom, backup.
Re: A plastic card for easy to remember strong passwords
#77Earlier quoted context omitted.
To get rid of the newlines shuf -n 4 /usr/share/dict/words | xargs | sed 's/ //g'
Or slightly more simply: echo `shuf -n 5 /usr/share/dict/words`
Maybe add this to your .bashrc file?
randword()
{
if [ -z $1 ]; then
echo `shuf --random-source=/dev/urandom -n 5 /usr/share/dict/words`
else
echo `shuf --random-source=/dev/urandom -n $1 /usr/share/dict/words`
fi
}
kobra@stormforge blah $ randword 4
crackpots fragmentation maximally Bradly's
kobra@stormforge blah $ randword 6
turnover's nonproliferation's bestowal's sulkier hillbilly Narmada
kobra@stormforge blah $ randword
Marciano fibulas roadwork mobilizations organics
kobra@stormforge blah $ randword
coins bronzed housemother's forefather supposingRe: A plastic card for easy to remember strong passwords
#78How about doing Vigenere in your head? This is what I do: I actually write my passwords down in my little black book, which I carry in my pocket. I use a simple Vigenere cypher in case I lose the book. Each password is encrypted with the same master key, which I memorize.
For example, if my master key was 1234, and my password was 'baNana3', it would write down 'ayKwmy0'. When I look up the password, I shift the letters forward as I type them:
a + 1 = b
y + 2 = a (wrap around the end of the alphabet)
K + 3 = N
w + 4 = a
m + 1 = n
y + 2 = a
0 + 3 = 3
It's not too hard to advance 9 or fewer letters in the alphabet as you type.
I think i'm safe. Am I?
Re: A plastic card for easy to remember strong passwords
#79This is a substitution cipher and it's not very secure. Consider what we can do if we compromise the Amazon password that's given as an example on the website: sh(/J3HqAfQsu..u.rqf Since the password came from Amazon, we know that the last 6 characters are "Amazon," which tells us that: . = A u = M r = Z q = O f = N Now we can start attacking the codeword, which are the characters between the 8-character "space bar c…
[deleted]
Re: A plastic card for easy to remember strong passwords
#80Earlier quoted context omitted.
There is no need to even break the codeword as it is the same for every site. In the above example say we want to guess their gmail password, it is probably: sh(/J3HqAfQsu.?u.?? We have only three characters to guess! OTOH this is only relevant for targeted attacks where the attacker has one password. This still protects you pretty well from bulk attacks (so long as the card is not widely used) and is miles better th…
The site is only an example. You would actually order your own unique card to carry with you. No one would be able to guess your password since your spacebar code is unique to your card.
That doesn't change the GP's point. One compromise means that password and spacebar code is compromised for all passwords. Other comments have already addressed how wimpy a substitution cipher is. Add to that that you can't reasonably cycle keys here, and you have yourself one pretty terrible password system.