Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Double Blind Passwords a.k.a. Horcruxing

kaizoku.dev

Post reply on HN
Print view View original

121–130 of 185 posts

Re: Double Blind Passwords a.k.a. Horcruxing

#121

Post by UncleMeat »

wyattpeak wrote: post #119
UncleMeat wrote: post #113

Earlier quoted context omitted.

How real is the evil maid threat model where they open up your password manager but don’t have enough time to install a key logger? And even if this threat model matters, 2fa defeats it. This entire horcrux system feels like cleverness for cleverness’ sake rather than actually addressing a meaningful threat model.

I don't have a strong opinion on the horcrux system. It's a simple solution to a minor class of threats. Six to one, half dozen to the other. My issue was that the "whole solution" to the problem proposed by the parent relies on idealised password manager usage which I don't think is representative of real-world use.

> It's a simple solution to a minor class of threats.

The threat models it addresses are (1) "evil maid without time to download a keylogger", (2) "cloud leak of your password database alongside sites that aren't using any 2fa" and (3) "cloud leak of your password database alongside SMS-based 2fa and a desire to go through the trouble to SIM-swap you".

All of these threat models are handled with TOTP-2FA. (1) is rare. (2) and (3) require your password manager to be compromised but not your application's password database.

In practice, virtually all threats to online accounts are phishing or password stuffing from database breaches. This system does not change your posture against these threats.

People will only follow so much security advice so you need the specific small set of things that you recommend to everybody to address the most common threats and you need the set of things you recommend to more targeted individuals to actually address a wide range of threats. Introducing additional systems that address a subset of meaningful threat models just introduces confusion.

"Use a password manager with autofill to generate unique passwords" defeats credential stuffing and most forms of phishing. This system is worse against phishing since you personally type in the password. "Use a password manager with autofill and a yubikey" fully defeats credential stuffing and phishing. It also defeats the situations addressed by horcruxes.

> My issue was that the "whole solution" to the problem proposed by the parent relies on idealised password manager usage which I don't think is representative of real-world use.

I do agree with this.

Re: Double Blind Passwords a.k.a. Horcruxing

#122

Post by almog »

While not being a bad idea, I think that any advantage of this method and double/triple locking your password manager (by an additional encryption layer) falls into the category of warm-fuzzy-feeling-of-security.

Also, while unlikely to pose a real threat, since this method literally breaks the 3rd rule introduced in the article ("Have a significantly different password for each account") and not only that, it does so by _appending_ a constant string to all your passwords, it introduces the potential risk in case a vulnerability is found in the cipher that's used to encrypt your passwords database.

Re: Double Blind Passwords a.k.a. Horcruxing

#123

Post by meribold »

_wldu wrote: post #88

I wrote a program to generate passwords based on user input about 10 years ago. I still use it today and a few teams I have worked with still use it. I called it DPG. Deterministic Password Generator. It is a similar concept. I have implemented it in Go, C++, Java and Python. I wish the idea of generating passwords when needed rather than storing and retrieving them was more popular. Traditional password Managers are…

Can it cope with services that disallow certain characters? Can it cope with services that require e.g. at least one digit, symbol, and capital letter?

Re: Double Blind Passwords a.k.a. Horcruxing

#124

Post by rakoo »

war1025 wrote: post #10
emmanueloga_ wrote: post #7

This is a cool/useful idea. I thought the article was gonna be about "Shamir's Secret Sharing" [1], "where a secret is divided into parts, giving each participant its own unique part. To reconstruct the original secret, a minimum number of parts is required.". Sounds horcruxy to me :-p. I learnt about it from the PIM book [2]. 1: https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing 2: https://pimbook.org/

I thought that algorithm was crazy magic when I first heard of it. The method behind it is pretty fascinating. A nth degree polynomial is uniquely identified by n+1 points. So the algorithm interprets your secret to a binary numeric value, sets that as the value at x=0 (i.e. the constant term of the polynomial), picks random coefficients for all the polynomial degrees, then computes coordinate pairs for however many…

The real magic is that even if you can bribe 5 people and discover their point, you don't gain any information: there is an infinite number of degree-6 polynomials that go through 5 points, so you don't know which polynomial is the correct one. With this method it's either "you have it" or "you don't", there's no step in between.

Re: Double Blind Passwords a.k.a. Horcruxing

#125

Post by meribold »

bootlooped wrote: post #5

If you hash the concatenated string result, and use the hash as your password, it also means your horcrux wouldn't be at all visible to services. That's a lot of extra work though.

This seems no better than a password manager that stores encrypted passwords but not the decryption key.

Re: Double Blind Passwords a.k.a. Horcruxing

#126

Post by meribold »

jiofih wrote: post #104

Isn’t the effect the same as having a second layer of encryption, i.e. a second master password that you enter on the client only, to unlock each password?

A second layer of encryption actually seems better since the key, unlike the horcrux, won't be leaked to all services.

Re: Double Blind Passwords a.k.a. Horcruxing

#127

Post by webmaven »

cduzz wrote: post #105
phantom_rehan wrote: post #93

Earlier quoted context omitted.

Horcruxes are similar to what emmanueloga_ has mentioned. Horcruxes were special things in which Harry Potter's lead antagonist, Voldemort stored parts of his 'soul', so that even if he died, someone cpuld revive him using the horcruxes. I haven't kept up with Harry Potter for a year now, so I might be wrong with respect to the exact definition.

A horcrux is a plot device where the protagonists need 2fa to send a HUP or TERM to the misbehaving process.

> A horcrux is a plot device where the protagonists need 2fa to send a HUP or TERM to the misbehaving process.

Okay, I didn't literally LOL, but you did earn a really big grin and even a chortle. Well done.

BTW, I would totally read "Harry Potter and the Protocols of Security". Some of the "Methods of Rationality" fan fiction by Eliezer Yudkowsky nods in that direction (eg. the Death Eaters' opsec).

Re: Double Blind Passwords a.k.a. Horcruxing

#128

Post by molszanski »

webmaven wrote: post #127
cduzz wrote: post #105

Earlier quoted context omitted.

A horcrux is a plot device where the protagonists need 2fa to send a HUP or TERM to the misbehaving process.

> A horcrux is a plot device where the protagonists need 2fa to send a HUP or TERM to the misbehaving process. Okay, I didn't literally LOL, but you did earn a really big grin and even a chortle. Well done. BTW, I would totally read "Harry Potter and the Protocols of Security". Some of the "Methods of Rationality" fan fiction by Eliezer Yudkowsky nods in that direction (eg. the Death Eaters' opsec).

I've heard good things about "Methods of Rationality". Worth reading?

Re: Double Blind Passwords a.k.a. Horcruxing

#129

Post by tgb »

chairmanwow1 wrote: post #71
vmarquet wrote: post #70

Earlier quoted context omitted.

I think the term "peppering" is mostly used for server side manipulation of the password, which the user is unaware of. It would be very confusing to reuse this term for what is described in this article, so a new term like "Horcruxing" can be relevant. I like it.

I think I really disagree with you there. This is the same concept but applied client-side instead of server-side. But “client-side peppering” won’t get you to the front page of HN..

I think these concepts are significantly different - as different as salts and peppers at least. Peppering helps protect against database access revealing password. Horcrux protects against password manager access. Peppering is stored on the server, but outside the database. Horcruxes are stored in the user's head. You could do both, one, or neither. Client-side peppering would be having part of your password outside of the password manager but still on your computer. If anything it's brain-side peppering.

Re: Double Blind Passwords a.k.a. Horcruxing

#130

Post by Ntrails »

> use a horcrux only for the most important logins - your social media, bank accounts etc.

Am I the only person who does a huge double take on this? If someone hacks a facebook or a twitter - what precisely am I scared of? My bank accounts are literally my net worth. If they get hacked I'm broke.

Why would I want a particularly strong password on Twitter or Facebook or Linkedin for that matter

Post reply on HN