Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Unbreakable crypto: Store a 30-character password in your subconscious memory

extremetech.com

Post reply on HN
Print view View original

11–20 of 91 posts

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#11

Post by mrsebastian »

colanderman wrote: post #8

Beside the title being misleading (it's a 30-symbol password, not 30-character, as "character" implies printable ASCII to most people), the math doesn't quite make sense: Before running, the game creates a random sequence of 30 letters chosen from S, D, F, J, K, and L, with no repeating characters. This equates to around 38 bits of entropy So that's 6 choices for the first character, and 5 choices for each of the nex…

Yep, from the research paper, page 4: http://bojinov.org/professional/usenixsec2012-rubberhose.pdf

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#13

Post by mrsebastian »

Robin_Message wrote: post #9
corin_ wrote: post #3

> If a judge or policeman orders you to hand over your password, you can plausibly say that you don’t actually know it Surely for this system to help in allowing you to plausibly say that, you'd have to reference this system (or equivalent) and demonstrate that it is indeed used for the authentication the police want access to. And in that case, surely the police could just say "in that case, please authenticate for…

Hopefully stress means that you won't be able to do it properly anyway, which means coercion is useless. The real problem is the device stores the password, so the real defence is the tamperproof-ness of the device, not whether you can be tricked or coerced into outputting the sequence.

Yeah, the research paper notes that they need to implement 'coercion detection'. From page 12:

"Since our aim is to prevent users from effectively transmitting the ability to authenticate to others, there remains an attack where an adversary coerces a user to authenticate while they are under ad- versary control. It is possible to reduce the effective- ness of this technique if the system could detect if the user is under duress. Some behaviors such as timed re- sponses to stimuli may detectably change when the user is under duress."

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#14

Post by raverbashing »

thematt wrote: post #5

Obligatory xkcd: http://xkcd.com/538/ Only this time you'll have to log-in/decrypt on the spot rather than cough up your password.

This

It may be an interesting research, but it certainly won't help with that issue (with noting passwords down maybe)

And one thing may happen, you can have no clue of what your password is, or write it down, but you may need to look at the sequence to remember it! (Piano players may identify there)

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#15

Post by adventureful »

Robin_Message wrote: post #9
corin_ wrote: post #3

> If a judge or policeman orders you to hand over your password, you can plausibly say that you don’t actually know it Surely for this system to help in allowing you to plausibly say that, you'd have to reference this system (or equivalent) and demonstrate that it is indeed used for the authentication the police want access to. And in that case, surely the police could just say "in that case, please authenticate for…

Hopefully stress means that you won't be able to do it properly anyway, which means coercion is useless. The real problem is the device stores the password, so the real defence is the tamperproof-ness of the device, not whether you can be tricked or coerced into outputting the sequence.

The problem with using coercion is, the people using it never believe it's useless regardless of what's coming out of your mouth.

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#16

Post by eggoa »

brittohalloran wrote: post #6

Quite the login method: 1) Tell me who you are, so I can load up your secret 30 character "password" from some database (the fact that this needs to be stored in a retrievable way makes this entire system insecure) 2) Here's one random sequence of 30 characters. Look at it for a little bit, ok now try to reproduce it from memory. 3) Repeat several times (not stated how many). 4) One of those attempts was your specifi…

I'm not sure you've got 3-4 right, but it doesn't matter. Step 1 sinks the whole thing.

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#17

Post by bunderbunder »

Nitpick: This is not unbreakable crypto. This is more of a more secure key storage mechanism. Perhaps also a good defense against phishing attacks.

And it's not unbreakable. For starters, this system absolutely requires that the passwords be stored in the clear.

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#18

Post by brittohalloran »

eggoa wrote: post #16
brittohalloran wrote: post #6

Quite the login method: 1) Tell me who you are, so I can load up your secret 30 character "password" from some database (the fact that this needs to be stored in a retrievable way makes this entire system insecure) 2) Here's one random sequence of 30 characters. Look at it for a little bit, ok now try to reproduce it from memory. 3) Repeat several times (not stated how many). 4) One of those attempts was your specifi…

I'm not sure you've got 3-4 right, but it doesn't matter. Step 1 sinks the whole thing.

There's also the fact that your password will ALWAYS be shown as one of the sequences. Would-be hacker just tries 5 times and notes that THIS sequence keeps showing up, that must be the right one.

Maybe there's a more obtuse use-case but this seems like more of a cool experiment on human memory than a practical cryptography tool.

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#19

Post by peterwwillis »

This is basically the same method I use for laptop hard disk encryption. I don't remember the password, but I typed it so many times my fingers remember exactly the pattern to type. Kind of like playing a piano.

Several times i've been drinking and am unable to remember how to log into my machine, because I can't replicate the pattern and don't remember the password. After 15 minutes of concentration it comes back.

Re: Unbreakable crypto: Store a 30-character password in your subconscious memory

#20

Post by DanBC »

> It also gives you deniability: If a judge or policeman orders you to hand over your password, you can plausibly say that you don’t actually know it

The UK law requires that you make the encrypted data intelligible. Since you have encrypted data there's a pretty good chance you have the software to decrypt it. "They" don't want the password, they want the data.

Failing to make the data intelligible (whether that's failing to provide the passphrase or whatever) carries a 2 year prison sentence for some people, with possibilities for a 5 year sentence for others.

tl:dr - this does not prevent law enforcement from getting the password.

Also, using this to guard against rubber hosing is stupid. People prepared to use torture will do so, whether there are laws preventing it or if it's going to provide any useful evidence or not.

---- EDIT: META:

Extremetech articles are really lousy. The self-posting by the author of a poorly written article is a problem; the heavy ad load is another problem, but I find it hard to believe that there isn't a vote ring up-voting these lousy articles.

A quick glance shows that about 90% of Mrs Ebastian's subs are to articles that they've written, for their employer.

Post reply on HN