Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A plastic card for easy to remember strong passwords

qwertycards.com

Post reply on HN
Print view View original

11–20 of 110 posts

Re: A plastic card for easy to remember strong passwords

#11

Post by agwa »

advisedwang wrote: post #10
agwa wrote: post #7

This is a substitution cipher and it's not very secure. Consider what we can do if we compromise the Amazon password that's given as an example on the website: sh(/J3HqAfQsu..u.rqf Since the password came from Amazon, we know that the last 6 characters are "Amazon," which tells us that: . = A u = M r = Z q = O f = N Now we can start attacking the codeword, which are the characters between the 8-character "space bar c…

There is no need to even break the codeword as it is the same for every site. In the above example say we want to guess their gmail password, it is probably: sh(/J3HqAfQsu.?u.?? We have only three characters to guess! OTOH this is only relevant for targeted attacks where the attacker has one password. This still protects you pretty well from bulk attacks (so long as the card is not widely used) and is miles better th…

With the codeword broken, we can narrow the gmail password down to a single unknown character!

  sh(/J3HqAfQsu.Qu.s?

Re: A plastic card for easy to remember strong passwords

#12

Post by chronial »

mason240 wrote: post #5

This would actually be very useful for my Google and LastPass password. I have everything else in my LastPass manager, but it is always trying to get into my google account from different places is difficult, so I have a rememberable password for both. This would let me keep a much more secure password for both.

Just use random words. Memorable passwords don’t have to be weak. Five random common english words are already very strong. Just make sure you don’t pick the words by hand.

Re: A plastic card for easy to remember strong passwords

#13

Post by jameshart »

agwa wrote: post #7

This is a substitution cipher and it's not very secure. Consider what we can do if we compromise the Amazon password that's given as an example on the website: sh(/J3HqAfQsu..u.rqf Since the password came from Amazon, we know that the last 6 characters are "Amazon," which tells us that: . = A u = M r = Z q = O f = N Now we can start attacking the codeword, which are the characters between the 8-character "space bar c…

It's vulnerable to a known ciphertext attack, yes. But the assumption of password usage is that the password itself is never stored - the ciphertext of this cipher should itself not be available to an attacker. An attacker looking to bruteforce a compromised file of passwords is going to struggle to figure out that your password is sh(/J3HqAfQsu..u.rqf. Even if they do find it, what would tip them off that it was generated by a substitution cipher, rather than a random password generator like LastPass? The fact it ends in a letter sequence that follows the repetition pattern of AMAZON? I think that's quite a stretch.

Re: A plastic card for easy to remember strong passwords

#14

Post by erglkjahlkh »

agwa wrote: post #7

This is a substitution cipher and it's not very secure. Consider what we can do if we compromise the Amazon password that's given as an example on the website: sh(/J3HqAfQsu..u.rqf Since the password came from Amazon, we know that the last 6 characters are "Amazon," which tells us that: . = A u = M r = Z q = O f = N Now we can start attacking the codeword, which are the characters between the 8-character "space bar c…

In other words, this card is cryptographically nonsense.

On the other hand, nearly every attack against passwords is non-targeted, software trolling for matches with word lists and such. A user of qwertycard is paradoxically safe, especially as single password (from for instance hacked database) does not contain telltales of being generated by substitution cipher.

In order to be in danger someone would have to either do some mathematical analysis, someone should have already tools looking for substitution ciphers, or someone should set up some application (scripts, whatever) to look for substition ciphers and break them.

Now the crucial part: No one bothers. Typically almost 9/10 of the targets use the same "catdog123" password on every site. They will be used because it is less work.

Unless you are in a risk of targeted attacks, these cards actually can improve your overall security, even despite the flaw in logic. (Which could be mitigated by the way, there are several ways to that.) In other words, non-geeks can benefit from this. My mom could.

Re: A plastic card for easy to remember strong passwords

#15

Post by stevewilhelm »

What prevents me from using this type of strategy is the inconsistent adoption of password requirements.

For example, some of the websites I use require passwords to contain at least one capital letter, or a digit, or a punctuation mark (e.g. ! ? #, etc.). But other Website do not allow punctuation marks or digits.

Some require a password of a minimum length, but a dwindling few can only accept fairly short maximum length password.

Re: A plastic card for easy to remember strong passwords

#16

Post by hyperbovine »

agwa wrote: post #7

This is a substitution cipher and it's not very secure. Consider what we can do if we compromise the Amazon password that's given as an example on the website: sh(/J3HqAfQsu..u.rqf Since the password came from Amazon, we know that the last 6 characters are "Amazon," which tells us that: . = A u = M r = Z q = O f = N Now we can start attacking the codeword, which are the characters between the 8-character "space bar c…

This sort of objection is raised whenever basically any mechanism for remembering strong passwords is presented. Much like many results in computational complexity, worst-case results are not necessarily indicative of real-world utility. To wit, in the scenario you outlined the attacker must a) know beforehand that the target was using this device; b) know beforehand that the inserted middle portion was vulnerable to a dictionary attack; c) have compromised at least one and more likely several websites; and d) obtained the cleartext password from each of said websites. This seems an almost comically unrealistic chain of events for the average case. Yes, a determined and sophisticated attacker could probably pull this off, but if you have enemies who are willing to go to such lengths you probably are aware of it and would not be using a silly little crutch in the first place. For the rest of us, this seems like a potentially useful alternative to using 'c@td0g11!' for everything.

Re: A plastic card for easy to remember strong passwords

#18

Post by samspot »

Except it's not going to work, because of the bank who doesn't allow '(' as a special character, or the ticket website that requires at least 3 digits, or the financial firm who only allows 8 character passwords. As soon as you have a few sites with 'rogue' password policies, the system breaks down.

Re: A plastic card for easy to remember strong passwords

#19

Post by gravedave »

hyperbovine wrote: post #16
agwa wrote: post #7

This is a substitution cipher and it's not very secure. Consider what we can do if we compromise the Amazon password that's given as an example on the website: sh(/J3HqAfQsu..u.rqf Since the password came from Amazon, we know that the last 6 characters are "Amazon," which tells us that: . = A u = M r = Z q = O f = N Now we can start attacking the codeword, which are the characters between the 8-character "space bar c…

This sort of objection is raised whenever basically any mechanism for remembering strong passwords is presented. Much like many results in computational complexity, worst-case results are not necessarily indicative of real-world utility. To wit, in the scenario you outlined the attacker must a) know beforehand that the target was using this device; b) know beforehand that the inserted middle portion was vulnerable to…

The rest of us could also make up our own password generating techniques as well, and have c@td0g11!el8oo8, c@td0g11!no5@m@ etc. el8oo8 is google backwards - but coming up with a word scrambling technique isn't hard, as many conspiracy theorists ought to know better.

This wouldn't provide cipher encoding, but someone already mentioned https://www.passwordcard.org/, and as you said, this is for the rest of us.

Re: A plastic card for easy to remember strong passwords

#20

Post by sarciszewski »

chronial wrote: post #12
mason240 wrote: post #5

This would actually be very useful for my Google and LastPass password. I have everything else in my LastPass manager, but it is always trying to get into my google account from different places is difficult, so I have a rememberable password for both. This would let me keep a much more secure password for both.

Just use random words. Memorable passwords don’t have to be weak. Five random common english words are already very strong. Just make sure you don’t pick the words by hand.

https://github.com/resonantcore/lib/blob/master/js/diceware/...

https://github.com/resonantcore/lib/blob/master/demo/dicewar...

Run this locally, e.g.

    dw = new Diceware();
    dw.load("https://raw.githubusercontent.com/resonantcore/lib/master/js/diceware/diceware.wordlist.asc", function() {
        console.log("Diceware loaded!");
    });

    console.log(dw.getWords(8).join(' '));
Post reply on HN