Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chroma-Hash: a sexy, non-reversible, live visualization of password field input

mattt.github.com

Post reply on HN
Print view View original

11–20 of 70 posts

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#11

Post by chaosmachine »

This is pretty, but non-reversible it isn't. The colors update with every keystroke, making it easy to determine letter by letter, which keys are being pressed. This is a significant hole in many situations (screencasts, recorded presentations, or anywhere someone can point a camera at your screen).

Simple fix: Wait for 300ms of keyboard inactivity before computing the colors. This way you only get the colors when the person is done typing, eliminating the possibility of key by key color analysis.

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#13

Post by paulgb »

DTrejo wrote: post #6

Now for some fun Douglas Hofstadter self-reference. Challenge: Can someone find a password that describes the colors it makes? e.g. "redgreenblue" shows red, green, and blue

"multicoloured" :-)

Not to just be a smart-ass, I tried a few others, but couldn't find any that worked well.

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#14

Post by MaMa »

paulgb wrote: post #7

Cool, but still vulnerable to attack by someone who can record video (or with really good memory). Even though the visualization is taken from a relatively small set of three-colour triplets, an attacker who has seen the visualization for every prefix of the password has enough information to figure out the password in linear time.

There could be a little animation or delay before showing the final "hash". Only the colors for the complete password are important.

And if somebody can take video of the screen they could take video of the keyboard too, no?

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#15

Post by paulgb »

Pistos2 wrote: post #9
paulgb wrote: post #7

Cool, but still vulnerable to attack by someone who can record video (or with really good memory). Even though the visualization is taken from a relatively small set of three-colour triplets, an attacker who has seen the visualization for every prefix of the password has enough information to figure out the password in linear time.

If someone is already shoulder surfing, wouldn't it be easier to look at the hands and keyboard than at the colour bars and asterisks?

I was thinking more of the case where someone thinks "how much information about my password could three patches of colour reveal?" and logs into their account during a recorded presentation.

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#16

Post by heroin »

I do not have time to read the code. But if the colors are generated using one way hash, this would be great to have on every site. Using of colors can be replaced by showing the hash in plain text. Everybody would remember their password colors, and typos in password would be history.

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#17

Post by mahmud »

Pistos2 wrote: post #8
jhdevos wrote: post #5

What an incredibly good idea! It would probably not be too difficult to build this as a firefox plugin, so that all password fields (or all blanked out input fields) on the web will automatically get this feature... Anyone? :-)

It seems to rely on jQuery, so a Firefox plugin, greasemonkey script, or Opera userjs would need to bundle or src jQuery. Whether or not that is okay I will leave on the table for debate and discussion. :)

if your script doesn't need to be platform-gotcha aware, you can always rewrite it in pure js.

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#18

Post by Jeremysr »

DTrejo wrote: post #6

Now for some fun Douglas Hofstadter self-reference. Challenge: Can someone find a password that describes the colors it makes? e.g. "redgreenblue" shows red, green, and blue

startpinkendgreen

Still trying to find one for all three colours. (This is fun! :P)

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#19

Post by ubernostrum »

DTrejo wrote: post #6

Now for some fun Douglas Hofstadter self-reference. Challenge: Can someone find a password that describes the colors it makes? e.g. "redgreenblue" shows red, green, and blue

"wildblueyonder" produces a blue bar on the far right.

"wild blue yonder" produces two blue bars on the left.

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#20

Post by NyxWulf »

As others have noted, this is not "non-reversible", at least in the current incarnation. Part of the problem is that if you type an 'a' you always get the same three color triplet.

It seems to me that the simplest fix would be to add something like a seed value to the input or the triplet colors and then randomly generate the seed each time the page is loaded. At that point someone replaying or recording the colors would have no idea what seed would have been generated, but as long as both fields use the same seed the color triplet would be identical for both.

Post reply on HN