> I started paying her to roll dice and make Diceware passwords for me.
Interesting way to incentivize their daughter to do something.
Lessons from a Professional Password Cracker
131–138 of 138 posts
Re: Lessons from a Professional Password Cracker
#132Re: Lessons from a Professional Password Cracker
#133Earlier quoted context omitted.
> The third thing is to match against specific leaks. E.g.: if you have john.smith@foo.com and there is a leak of his email and password where the password matches your records, force a password change immediately. I’ve wanted to do something similar but how would you do this without direct access to HIBP’s data? I don’t want to send customer email addresses to a third party, at least not without a contract.
For what it's worth RE: HIBP, the lookup is never actually done on an email address. If you use the API ( https://haveibeenpwned.com/API/v2#SearchingPwnedPasswordsByR... , or https://api.pwnedpasswords.com/range/3E398 to see the API result), you transmit 5 characters of the SHA1 hash of the email address and check if the full hash is in the list. This makes it possible to use the API without worrying about user priva…
I had no idea, thank you for opening my mind to this!
Re: Lessons from a Professional Password Cracker
#134I'm surprised a password cracker would advocate switching to biometrics, the one type of password you can't change.
I've really embraced biometrics now that I understand that they're effective for certain use-cases when properly implemented.
For example, the primary threat model for my mobile device is a combination of shoulder-surfing and theft, because I ride a lot of public transit. So it's way more secure for me to touch the fingerprint sensor rather than constantly peck in my password while I'm being observed. A common criminal or homeless dude who steals/finds my phone won't know my password because I'm not revealing it, and they're unlikely to have access to my finger or its print.
If my threat model were different, say law enforcement/TSA confiscation or something, I might be more worried about walking around with fingerprint auth enabled. So if I head to the airport or enter some other high-risk area, I might consider disabling that, removing the sdcard and/or SIM card temporarily.
Biometrics as a way for my personal device to recognize my physical presence is mature tech, and useful for consumers in ways that passwords aren't.
Re: Lessons from a Professional Password Cracker
#135Earlier quoted context omitted.
My country has my fingerprints because I have an id document like everybody else. A number of states around the world have my fingerprints too because I entered those countries as tourist and I had to put at least one finger on a reader. Maybe some country included mine also have my retina scan, I had to look into some cameras sometimes. All those biometric information could be leaked, sold by corrupt civil servants…
>All those biometric information could be leaked, sold by corrupt civil servants or exchanged with other countries so random passwords generated by a password manager protects me more than biometric information. Am I wrong? I know of zero biometric implementations where your biometric data is uploaded to the server for verification. All the biometric implementations I've seen (windows hello, icloud passkey) perform b…
I'm sure that there are plenty of nasty scenarios.
This is one.
1. The attackers create my.name@somedomain.com / my.name.12345@gmail.com and/or use a throw away phone number (especially if the email provider uses some 2FA linked to a phone.)
2. They register an account on a web service using that email or install an app on that phone, maybe a virtualized one. Upload a picture of me as icon or fake one.
3. Use my fingerprints on their phone to get through any possible biometric 2FA.
4. They are me.
If they find a way to automate all those steps or make the labor costs small they can register a lot of bots that are real people, because 2FA says so. It's up to their imagination to find a way to profit from that.
Re: Lessons from a Professional Password Cracker
#136Re: Lessons from a Professional Password Cracker
#137Earlier quoted context omitted.
Evidently not https://news.ycombinator.com/threads?id=hunter2_&next=106866...
Maybe he made it long in the past for the future opportunity to be in this very thread.
If you search my account, you'll find something like 4 threads of this nature over the years :)
Re: Lessons from a Professional Password Cracker
#138Earlier quoted context omitted.
Indeed. Also in legal terms. In the Netherlands, the police can hold your finger to the fingerprint reader on a device they confiscated (might need a court order, or might depend on circumstances if there is an imminent threat to life or something), but they cannot order you to work on your own prosecution in general. Why, then, you can be ordered to put your finger on the pad, I have no idea, but it has been ruled t…
The solution there is to set aside a few less-used fingers which, when applied to the scanner in sequence, tell it to perform a secure wipe. I'm left-handed so I use a few fingers on my right hand plus my left little finger for access, this leaves enough fingers for a fingerprint-directed wipe command: left index followed by left ring followed by left middle => Wipe There is bound to be an app or option in some AOSP-…
You will almost always use one or two fingers to unlock your phone due to the fingerprint readers position and the police might be intelligent enough to ask you to put that exact finger on.