Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Double Blind Passwords a.k.a. Horcruxing

kaizoku.dev

Post reply on HN
Print view View original

111–120 of 185 posts

Re: Double Blind Passwords a.k.a. Horcruxing

#111

Post by UncleMeat »

_wldu wrote: post #91
jakubp wrote: post #90

This doesn't address the key issue of how many "in head" horcruxes you want to have. Is it one and the same for all passwords? Then two broken passwords reveals it (if someone's clever maybe even 1, not sure here). If it's different for different passwords, you now need to memorize (or store elsewhere) a list of many, many such horcruxes. Not 7... but maybe a 100 or 200 to be practical for a heavy user of internet ap…

I have about 400 DPG passwords all stored in my head. https://github.com/62726164/dpg

Now teach my grandma to do that.

Experts can go buy yubikeys and achieve far greater security for less work. Everything else needs to work for the masses.

Re: Double Blind Passwords a.k.a. Horcruxing

#112

Post by jerezzprime »

GoblinSlayer wrote: post #69
red0point wrote: post #50

Earlier quoted context omitted.

Can you elaborate on why all security will eventually rely on obscurity?

It's jokingly called Fleming's cryptanalysis: if there's a secret key, you just send James Bond to steal it.

https://xkcd.com/538/

Re: Double Blind Passwords a.k.a. Horcruxing

#113

Post by UncleMeat »

wyattpeak wrote: post #89
l1am0 wrote: post #84

Isn't the whole solution to the problem: 1) Choose a good master password for you password manager 2) Remember it 3) !!! Don't write it down anywhere !!!

I think there are a couple of problems in practice with this: 1) I don't leave my password manager open overnight, but I do during the day. My master password is long and I enter a lot of passwords. The most obvious attack vector is getting onto my computer while I'm working, not cracking the master password. 2) Losing my master password would be a _big fucking problem_. Once I'm confident I've learned it I destroy w…

How real is the evil maid threat model where they open up your password manager but don’t have enough time to install a key logger? And even if this threat model matters, 2fa defeats it.

This entire horcrux system feels like cleverness for cleverness’ sake rather than actually addressing a meaningful threat model.

Re: Double Blind Passwords a.k.a. Horcruxing

#114

Post by rozab »

emmanueloga_ wrote: post #7

This is a cool/useful idea. I thought the article was gonna be about "Shamir's Secret Sharing" [1], "where a secret is divided into parts, giving each participant its own unique part. To reconstruct the original secret, a minimum number of parts is required.". Sounds horcruxy to me :-p. I learnt about it from the PIM book [2]. 1: https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing 2: https://pimbook.org/

The main implementation is called horcrux.

https://github.com/jesseduffield/horcrux

This is basically a low tech (and much more unsecure) version of the n=2 case.

Re: Double Blind Passwords a.k.a. Horcruxing

#115

Post by UncleMeat »

Aachen wrote: post #77
anonymouse008 wrote: post #60

Earlier quoted context omitted.

With a degree of complexity removed since the key doesn’t change over time.

Removed? Do you regularly change passwords? I can see the point when using a password manager, though it's typically overkill, but please be aware that forcing memorized secrets to be changed arbitrarily (e.g. time-based) is recommended not to do in the updated guidelines from USA's NIST, UK's NCSC, Microsoft, and others based on research into what effect it has on password quality.

But the expectation is that something does change (the 2fa). If you use this system without a second factor then a hash breach screws you. And if you do have a second factor then this system achieves almost nothing.

Re: Double Blind Passwords a.k.a. Horcruxing

#116

Post by Summershard »

_wldu wrote: post #88

I wrote a program to generate passwords based on user input about 10 years ago. I still use it today and a few teams I have worked with still use it. I called it DPG. Deterministic Password Generator. It is a similar concept. I have implemented it in Go, C++, Java and Python. I wish the idea of generating passwords when needed rather than storing and retrieving them was more popular. Traditional password Managers are…

Another open-source tool for that is Master Password:

https://masterpassword.app/

Re: Double Blind Passwords a.k.a. Horcruxing

#119

Post by wyattpeak »

UncleMeat wrote: post #113
wyattpeak wrote: post #89

Earlier quoted context omitted.

I think there are a couple of problems in practice with this: 1) I don't leave my password manager open overnight, but I do during the day. My master password is long and I enter a lot of passwords. The most obvious attack vector is getting onto my computer while I'm working, not cracking the master password. 2) Losing my master password would be a _big fucking problem_. Once I'm confident I've learned it I destroy w…

How real is the evil maid threat model where they open up your password manager but don’t have enough time to install a key logger? And even if this threat model matters, 2fa defeats it. This entire horcrux system feels like cleverness for cleverness’ sake rather than actually addressing a meaningful threat model.

I don't have a strong opinion on the horcrux system. It's a simple solution to a minor class of threats. Six to one, half dozen to the other.

My issue was that the "whole solution" to the problem proposed by the parent relies on idealised password manager usage which I don't think is representative of real-world use.

Re: Double Blind Passwords a.k.a. Horcruxing

#120

Post by inopinatus »

vmarquet wrote: post #70
chipsa wrote: post #46

I saw this post a while ago in a different forum. My note for it hasn't changed: This is called peppering[0]. It's a counterpart to salting, in that you add a random value to a password to make it harder to reverse the password hash, but unlike the salt, it's not stored in the password database. 0: https://en.wikipedia.org/wiki/Pepper_(cryptography)

I think the term "peppering" is mostly used for server side manipulation of the password, which the user is unaware of. It would be very confusing to reuse this term for what is described in this article, so a new term like "Horcruxing" can be relevant. I like it.

I fear it may be unfair to expect most end-users to apply this scheme appropriately and consistently, and therefore recommend that it be known as mustard.
Post reply on HN