Password Typos and How to Correct Them Securely (2016) [pdf] • Hacker News Board

Re: Password Typos and How to Correct Them Securely (2016) [pdf]

#11

Post by nirmalkant » Sat, Jun 17, 2017, 2:34 PM UTC

swordswinger12 wrote: post #6

glitcher wrote: post #3

> "In future work, we plan to investigate whether typo-tolerance will actually serve to improve overall security. Because allowing for password typos increases login success rates in benign scenarios, it may help to make adversarial login attempts stick out. This would strengthen the signals used to detect online password attacks as used in Internet-scale authentication systems." My initial thought was that such a sy…

Another really interesting potential benefit of this work is enabling users to create longer, more complicated passwords. The idea is that if users are less encumbered by typos and small errors, they'll be able to use stronger passwords while devoting the same amount of "brain space" (so to speak) to correctly using them. EDIT: The authors are probably too modest to tout this, so I'll do it for them: this work won "B…

Password security is always important and I agree with one point that longer you create the password, the better it is. But there are more points we should be aware of and I think this article explaining at its best -http://gotowebsecurity.com/now-thats-password-security/

Re: Password Typos and How to Correct Them Securely (2016) [pdf]

#12

Post by unholiness » Sat, Jun 17, 2017, 2:44 PM UTC

Real users have passwords that are simple mutations from passwords they used elsewhere. They'll change a 1 to a 2 to make it unique and safe, or change an o to a 0 to fulfill the next site's requirements.

I don't buy the idea that being typo tolerant only helps the real account owner if it's also opaquely increasing the amount of password reuse across sites. Not to mention that the code handling the typo comparison is a pretty large new surface area for attack, all in the name of optimizing the experience for typing passwords by hand (a practice we should actively reduce).

Re: Password Typos and How to Correct Them Securely (2016) [pdf]

#13

Post by unholiness » Sat, Jun 17, 2017, 3:00 PM UTC

freshhawk wrote: post #9

glitcher wrote: post #3

> "In future work, we plan to investigate whether typo-tolerance will actually serve to improve overall security. Because allowing for password typos increases login success rates in benign scenarios, it may help to make adversarial login attempts stick out. This would strengthen the signals used to detect online password attacks as used in Internet-scale authentication systems." My initial thought was that such a sy…

What would a solution even look like with less friction than what we have now? You can hit a key shortcut, pull up a list, select the password and it's done. I personally hit one keyboard shortcut, type a few characters into a fuzzy matching narrowing list, hit enter and the password is in my clipboard (password-store + dmenu) and there are equally minimal friction GUI versions of the same. Total blue sky it, or desc…

The friction isn't about the workflow when the system just works.

There are gains to be made in situations where I'm using another computer, or my phone, or the password manager isn't recognizing the site properly, or isn't finding the right the input fields.

But mostly the friction is in front of all those users who don't use password managers. There are gains to be made in making the setup process simple, secure, and predictable. There are gains in making it cross-browser, cross-platform, and well-integrated with the setup process for browsers and operating systems.

Users "don't want" most things, until a lot of thought and effort gets made to create a wholistic solutions that just work.

Re: Password Typos and How to Correct Them Securely (2016) [pdf]

#14

Post by setr » Sat, Jun 17, 2017, 6:02 PM UTC

freshhawk wrote: post #9

glitcher wrote: post #3

> "In future work, we plan to investigate whether typo-tolerance will actually serve to improve overall security. Because allowing for password typos increases login success rates in benign scenarios, it may help to make adversarial login attempts stick out. This would strengthen the signals used to detect online password attacks as used in Internet-scale authentication systems." My initial thought was that such a sy…

What would a solution even look like with less friction than what we have now? You can hit a key shortcut, pull up a list, select the password and it's done. I personally hit one keyboard shortcut, type a few characters into a fuzzy matching narrowing list, hit enter and the password is in my clipboard (password-store + dmenu) and there are equally minimal friction GUI versions of the same. Total blue sky it, or desc…

Well for one, using a generated password on a machine I don't own (ie a library computer) is a PITA, and thats if I have my phone. If its elsewhere for whatever reason, then I'm simply fucked since I'm no longer the source of truth.

However, I'm not sure if hardware solutions like yubikey solve this (particularly for initial logon, or "interfaces", like a computer serving solely as a printer terminal)

But anyways, the easy case is when the manager is trivially available; the hard case to solve is when its not. You can instead imagine a world where all computers by standard support some interface for hardware login in all states of operation, and by standard practice, people keep this hardware on them, and you'd have a significant improvement on the state of affairs. (ie nfc authentication by phone)