Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HashMask - Another (More Secure) Experiment in Password Masking

lab.arc90.com

Post reply on HN
Print view View original

11–20 of 32 posts

Re: HashMask - Another (More Secure) Experiment in Password Masking

#11

Post by umbrae »

tptacek wrote: post #4

No, this is retarded; the "unique nonreversable visualization" is trivially attacked offline by brute forcing with a dictionary of passwords. It's just the SHA1 of your password; fundamentally no different from tacking /etc/shadow to your password field as you type. It wouldn't be retarded if it wasn't expending a lot of effort (and confusing the hell out of users) to get to that bad destination. But that's what it d…

Well, as the author, I feel I better defend myself here.

A: It only uses the first 20 bytes of the hash. You could narrow it down from this if you were really determined, but you'd not be able to reverse it.

B: The visualization of the sparkline doesn't have the fidelity to determine between characters 6 and 7. So you'd have a range of possible characters.

C: The alternative being suggested by Jakob Nielsen is no masking at all ( http://www.useit.com/alertbox/passwords.html ) - which is less secure? I know this isn't the best argument, but it still is -an- argument.

With that out of the way, my paranoid mind agrees with you in this context: just masking the passwords is the more secure solution. But that doesn't mean that experiments to provide a more usable approach with (arguably) equal security should be avoided.

Re: HashMask - Another (More Secure) Experiment in Password Masking

#12

Post by tptacek »

sho wrote: post #8
tptacek wrote: post #6

Earlier quoted context omitted.

I did it about 50 times today. I'm a building full of cameras. Tell me, how often do you sweep the surrounding area for cameras before you log in somewhere? Thought so. How many times have you ever logged into something from an airport? Ever hear about the Microsoft Blue Hat talks about the pen testers who collect credentials at Sea-Tac? People just like memes. They're fun to talk about. I promise you there are 1,000…

Why are you worried about how people with cameras could eventually brute force your password from that tiny, fuzzy smear of colour on the screen, when those same cameras can see your fingers typing the whole damn thing in, in plaintext?

Because those cameras can see my screen easily, and not my fingers typing on the screen? Because my fingers aren't perpendicular to the floor? Because even if I was going to concede that the image of the SHA graph was going to be fuzzy, just getting the vicinity of the color reduces my search space by 1/2^(16..24)?

I love "cameras could eventually brute force" in your sentence, as if we were actually talking about some crazy hard feat of image analysis and cryptography, rather than running a dictionary through SHA1 and comparing colors.

Got any more arguments, sho?

Re: HashMask - Another (More Secure) Experiment in Password Masking

#14

Post by tptacek »

umbrae wrote: post #11
tptacek wrote: post #4

No, this is retarded; the "unique nonreversable visualization" is trivially attacked offline by brute forcing with a dictionary of passwords. It's just the SHA1 of your password; fundamentally no different from tacking /etc/shadow to your password field as you type. It wouldn't be retarded if it wasn't expending a lot of effort (and confusing the hell out of users) to get to that bad destination. But that's what it d…

Well, as the author, I feel I better defend myself here. A: It only uses the first 20 bytes of the hash. You could narrow it down from this if you were really determined, but you'd not be able to reverse it. B: The visualization of the sparkline doesn't have the fidelity to determine between characters 6 and 7. So you'd have a range of possible characters. C: The alternative being suggested by Jakob Nielsen is no mas…

(a) This sentence doesn't make any sense. You can't "reverse" full SHA1 any more than you can "reverse" truncated SHA1. And SHA1 hashes are only 20 bytes long. Reversing isn't the attack.

(b) The goal of the attack isn't to magically conjure the password; it's to magically conjure a searchlist of several tens of passwords, which is a game-changing improvement over a searchlist of, say, 72^8 passwords, or even tens of thousands of dictionary words.

(c) The alternative suggested by Jakob Nielson is manifestly and categorically asinine.

Good on you for a finding an application for visualizing a SHA1 hash. You score maximum points for cleverness. But now you should retire this idea.

Re: HashMask - Another (More Secure) Experiment in Password Masking

#15

Post by lhorie »

tptacek wrote: post #4

No, this is retarded; the "unique nonreversable visualization" is trivially attacked offline by brute forcing with a dictionary of passwords. It's just the SHA1 of your password; fundamentally no different from tacking /etc/shadow to your password field as you type. It wouldn't be retarded if it wasn't expending a lot of effort (and confusing the hell out of users) to get to that bad destination. But that's what it d…

>> model it against an adversary with a camera.

Which can record your hands? :)

I figure that the offline dictionary attack could be foiled if this was a Firefox extension that generated a random salt on installation. (of course, this doesn't work if you want to play WOW on an Internet Cafe)

My main reaction to the experiment is that I don't know many people who touch type (at least when it comes to their password): I've had people accidentally type their password on the username field in front of me countless times because they weren't even looking at the screen.

I don't see why I should worry about big brother FUD when I could embarrass myself any time by accidentally pressing caps lock instead of tab.

Re: HashMask - Another (More Secure) Experiment in Password Masking

#16

Post by paulgb »

tptacek wrote: post #4

No, this is retarded; the "unique nonreversable visualization" is trivially attacked offline by brute forcing with a dictionary of passwords. It's just the SHA1 of your password; fundamentally no different from tacking /etc/shadow to your password field as you type. It wouldn't be retarded if it wasn't expending a lot of effort (and confusing the hell out of users) to get to that bad destination. But that's what it d…

If the attacker had a video camera and the victim was a slow enough typer (I'm thinking hunt-and-pecker), brute force wouldn't even be necessary. You could incrementally build up a string that matched the password as each letter was typed using the hash generated after each letter is typed.

Fidelity of the graphs wouldn't matter at this point, you would just take the closest match and backtrack if necessary.

Re: HashMask - Another (More Secure) Experiment in Password Masking

#17

Post by sho »

tptacek wrote: post #12
sho wrote: post #8

Earlier quoted context omitted.

Why are you worried about how people with cameras could eventually brute force your password from that tiny, fuzzy smear of colour on the screen, when those same cameras can see your fingers typing the whole damn thing in, in plaintext?

Because those cameras can see my screen easily, and not my fingers typing on the screen? Because my fingers aren't perpendicular to the floor? Because even if I was going to concede that the image of the SHA graph was going to be fuzzy, just getting the vicinity of the color reduces my search space by 1/2^(16..24)? I love "cameras could eventually brute force" in your sentence, as if we were actually talking about so…

If someone is trying to learn your password from cameras nearby, they will make sure they can see your keyboard. Of course. If you're in that kind of hostile environment, nothing is safe except biometric or card authentication. Your concern is misplaced.

You should have raised the scenario of, say, spying on a screen through a window from the other side of the street. That's a much better example and in that one, you might actually have a point, although I understand it's against the rules in many organisations to allow a screen to face a window. But the "in the same building" one was ridiculous. Why bother brute forcing your squiggly coloured blotch when they can just put a tiny camera in every light, or whatever?

No, no further arguments. I agree it's a bad idea, of course.

Re: HashMask - Another (More Secure) Experiment in Password Masking

#18

Post by tptacek »

lhorie wrote: post #15
tptacek wrote: post #4

No, this is retarded; the "unique nonreversable visualization" is trivially attacked offline by brute forcing with a dictionary of passwords. It's just the SHA1 of your password; fundamentally no different from tacking /etc/shadow to your password field as you type. It wouldn't be retarded if it wasn't expending a lot of effort (and confusing the hell out of users) to get to that bad destination. But that's what it d…

>> model it against an adversary with a camera. Which can record your hands? :) I figure that the offline dictionary attack could be foiled if this was a Firefox extension that generated a random salt on installation. (of course, this doesn't work if you want to play WOW on an Internet Cafe) My main reaction to the experiment is that I don't know many people who touch type (at least when it comes to their password):…

Another thing I love about this discussion is the intimation ("big brother") that in order to get a picture of my screen, you have to be the NSA. And not, you know, some jackass with a camera.

Re: HashMask - Another (More Secure) Experiment in Password Masking

#19

Post by umbrae »

tptacek wrote: post #14
umbrae wrote: post #11

Earlier quoted context omitted.

Well, as the author, I feel I better defend myself here. A: It only uses the first 20 bytes of the hash. You could narrow it down from this if you were really determined, but you'd not be able to reverse it. B: The visualization of the sparkline doesn't have the fidelity to determine between characters 6 and 7. So you'd have a range of possible characters. C: The alternative being suggested by Jakob Nielsen is no mas…

(a) This sentence doesn't make any sense. You can't "reverse" full SHA1 any more than you can "reverse" truncated SHA1. And SHA1 hashes are only 20 bytes long. Reversing isn't the attack. (b) The goal of the attack isn't to magically conjure the password; it's to magically conjure a searchlist of several tens of passwords, which is a game-changing improvement over a searchlist of, say, 72^8 passwords, or even tens of…

(a) I wrote in haste. Obviously it's a one way hash and unreversible. Additionally, I meant the first 20 characters, which is half of the full hash.

(b) Obviously. Still extraordinarily difficult given this implementation IMO. But I take your point genuinely.

(c) Agreed.

If you weren't so friggin inflammatory I'd think we could come to a conclusion here. I could definitely be using a more lossy visualization to be more secure. This is something I'll look into, even though I'm sure you'll still consider it 'retarded' even if it helps your grandma login to her googles more often, making you get less phone calls to fix it as a result. She's got that palsy you know.

Re: HashMask - Another (More Secure) Experiment in Password Masking

#20

Post by tptacek »

paulgb wrote: post #16
tptacek wrote: post #4

No, this is retarded; the "unique nonreversable visualization" is trivially attacked offline by brute forcing with a dictionary of passwords. It's just the SHA1 of your password; fundamentally no different from tacking /etc/shadow to your password field as you type. It wouldn't be retarded if it wasn't expending a lot of effort (and confusing the hell out of users) to get to that bad destination. But that's what it d…

If the attacker had a video camera and the victim was a slow enough typer (I'm thinking hunt-and-pecker), brute force wouldn't even be necessary. You could incrementally build up a string that matched the password as each letter was typed using the hash generated after each letter is typed. Fidelity of the graphs wouldn't matter at this point, you would just take the closest match and backtrack if necessary.

Oh wow, I didn't even notice that it generated graphs on a keystroke/timer (though, I mean, duh). Wow, is this bad. Number of mask dots, 2 midpoint colors, and the final color; how many passwords in any dictionary does that reduce to?
Post reply on HN