Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Double Blind Passwords a.k.a. Horcruxing

kaizoku.dev

Post reply on HN
Print view View original

101–110 of 185 posts

Re: Double Blind Passwords a.k.a. Horcruxing

#101

Post by methodsignature »

jakubp wrote: post #90

This doesn't address the key issue of how many "in head" horcruxes you want to have. Is it one and the same for all passwords? Then two broken passwords reveals it (if someone's clever maybe even 1, not sure here). If it's different for different passwords, you now need to memorize (or store elsewhere) a list of many, many such horcruxes. Not 7... but maybe a 100 or 200 to be practical for a heavy user of internet ap…

A 2nd password manager for the 2nd part of the password breaks maybe the key advantage of this mechanism by putting the "something you know" into a decryptable by design storage space that is most likely duplicated in the cloud.

Re: Double Blind Passwords a.k.a. Horcruxing

#102

Post by melonkidney »

_wldu wrote: post #88

I wrote a program to generate passwords based on user input about 10 years ago. I still use it today and a few teams I have worked with still use it. I called it DPG. Deterministic Password Generator. It is a similar concept. I have implemented it in Go, C++, Java and Python. I wish the idea of generating passwords when needed rather than storing and retrieving them was more popular. Traditional password Managers are…

Around 5 years ago I wrote something very similar, for the same reasons as you. It was never intended to be more than a proof of concept, but I've ended up using it most every day.

Mine is web based, but all implemented in the front-end; no data is ever sent to the server.

I was debating whether to post the URL, because I don't really want a bunch of people to start depending on it the way I do (I have zero plans to maintain/improve it). But I feel like there may be sufficient interest. So the URL is in my profile for the next 48 hours.

Re: Double Blind Passwords a.k.a. Horcruxing

#103

Post by 101008 »

Dylan16807 wrote: post #62
GoblinSlayer wrote: post #42

Earlier quoted context omitted.

>And if no password databases are available, the attacker can create a website and ask you to join it under the hope you'll reuse your horcrux on the attacker's site. Some sites email your password to you: https://plaintextoffenders.com/

With two important notes: 1) A site that emails you your password might not be storing it in plain text. They're similar but separate problems. 2) A site that sends you a login link could be just as bad as the sites listed here, if that login link doesn't expire (and you used a unique password). It's a more subtle way of having the same problem.

Honest question: If you send it on the email without storing (just sending appending the $password variable to the email body), what would be the problem?

Re: Double Blind Passwords a.k.a. Horcruxing

#105

Post by cduzz »

phantom_rehan wrote: post #93
molszanski wrote: post #85

Earlier quoted context omitted.

I would click “client-side peppering” over horxsomething, didn't read Harry Potter

Horcruxes are similar to what emmanueloga_ has mentioned. Horcruxes were special things in which Harry Potter's lead antagonist, Voldemort stored parts of his 'soul', so that even if he died, someone cpuld revive him using the horcruxes. I haven't kept up with Harry Potter for a year now, so I might be wrong with respect to the exact definition.

A horcrux is a plot device where the protagonists need 2fa to send a HUP or TERM to the misbehaving process.

Re: Double Blind Passwords a.k.a. Horcruxing

#106

Post by UncleMeat »

101008 wrote: post #103
Dylan16807 wrote: post #62

Earlier quoted context omitted.

With two important notes: 1) A site that emails you your password might not be storing it in plain text. They're similar but separate problems. 2) A site that sends you a login link could be just as bad as the sites listed here, if that login link doesn't expire (and you used a unique password). It's a more subtle way of having the same problem.

Honest question: If you send it on the email without storing (just sending appending the $password variable to the email body), what would be the problem?

Some email is still sent unencrypted over the web so people snooping on traffic could see it.

Re: Double Blind Passwords a.k.a. Horcruxing

#107

Post by bitexploder »

_wldu wrote: post #88

I wrote a program to generate passwords based on user input about 10 years ago. I still use it today and a few teams I have worked with still use it. I called it DPG. Deterministic Password Generator. It is a similar concept. I have implemented it in Go, C++, Java and Python. I wish the idea of generating passwords when needed rather than storing and retrieving them was more popular. Traditional password Managers are…

This would be too hard for the average computer user. I love the concept and could see it working for more technical users, though. There are definitely some risk trade offs over traditional password managers, though. To start: Humans have biases. Randomly generated passwords don’t have any biases. I would have to think more on this from a cryptography perspective as well, but I think it’s a cool idea :)

Re: Double Blind Passwords a.k.a. Horcruxing

#108

Post by Blikkentrekker »

TacoSteemers wrote: post #49

It seems to me that this does not add a lot of security if you use the same extra word for all passwords. It probably does add a lot of security if you use a different extra word for each password, but then you can't remember them anymore and you need to write them down somewhere.

I am honestly somewhat confused by this newfound lack of confidence in human memory.

When I was 12 years old, everyone around me could easily remember up to 50 different 10 digit phone numbers, I still remember those.

Re: Double Blind Passwords a.k.a. Horcruxing

#109

Post by thedanbob »

101008 wrote: post #103
Dylan16807 wrote: post #62

Earlier quoted context omitted.

With two important notes: 1) A site that emails you your password might not be storing it in plain text. They're similar but separate problems. 2) A site that sends you a login link could be just as bad as the sites listed here, if that login link doesn't expire (and you used a unique password). It's a more subtle way of having the same problem.

Honest question: If you send it on the email without storing (just sending appending the $password variable to the email body), what would be the problem?

Any mail server the email happens to pass through is able to read/log the entire content of the message.

Re: Double Blind Passwords a.k.a. Horcruxing

#110

Post by methodsignature »

posix_me_less wrote: post #98
thaumaturgy wrote: post #76

This is not an improvement over just using the click-to-login features of modern password managers. Modern password managers generate strong random passwords and integrate with login forms in your desktop browser and on your mobile device. There are some exceptions with sites or applications that don't behave well, but as a general rule: you should not ever need to know any of your passwords anyway. You should be cli…

> you're just adding friction to a process that should be as frictionless as possible, because friction causes people to make bad decisions Integrating a password manager with a browser is too fragile and risky way of using both. It is best to have them fully separated so they can't communicate. They should communicate exclusively via the user. The login process should have some friction and should not be fully autom…

> Integrating a password manager with a browser is too fragile and risky way of using both. It is best to have them fully separated so they can't communicate. They should communicate exclusively via the user.

Which gets targeted more and why, the user or the password manager?

If you are suggesting that we should be manually entering passwords into sites as copied/observed from our password managers, that removes the anti-phishing benefits of password managers altogether by giving primary control back to the human. If I never type a password again, those hackers sending fake login page links "from my boss" will never gain me. Not so with no direct connection between my password manager and my browser.

Post reply on HN