Double Blind Passwords a.k.a. Horcruxing • Hacker News Board

Re: Double Blind Passwords a.k.a. Horcruxing

#141

Post by Thorrez » Tue, Dec 22, 2020, 4:44 PM UTC

Dylan16807 wrote: post #62

GoblinSlayer wrote: post #42

Earlier quoted context omitted.

>And if no password databases are available, the attacker can create a website and ask you to join it under the hope you'll reuse your horcrux on the attacker's site. Some sites email your password to you: https://plaintextoffenders.com/

With two important notes: 1) A site that emails you your password might not be storing it in plain text. They're similar but separate problems. 2) A site that sends you a login link could be just as bad as the sites listed here, if that login link doesn't expire (and you used a unique password). It's a more subtle way of having the same problem.

For 2, if it's a password that the user chose, the site should never email it, because the user likely reused that password across many sites, and someone who snoops on the user's email (say a housemate) can get the password to a ton of sites.

If it's a password generated by the site, then it's actually fine to email it. Although you likely don't want it too early in the email that it would show up in a phone notification or in a body summary in gmail.

Re: Double Blind Passwords a.k.a. Horcruxing

#142

Post by ComodoHacker » Tue, Dec 22, 2020, 4:49 PM UTC

molszanski wrote: post #128

webmaven wrote: post #127

Earlier quoted context omitted.

> A horcrux is a plot device where the protagonists need 2fa to send a HUP or TERM to the misbehaving process. Okay, I didn't literally LOL, but you did earn a really big grin and even a chortle. Well done. BTW, I would totally read "Harry Potter and the Protocols of Security". Some of the "Methods of Rationality" fan fiction by Eliezer Yudkowsky nods in that direction (eg. the Death Eaters' opsec).

I've heard good things about "Methods of Rationality". Worth reading?

Definitely, even without the original.

Re: Double Blind Passwords a.k.a. Horcruxing

#143

Post by nicwolff » Tue, Dec 22, 2020, 4:52 PM UTC

Ntrails wrote: post #130

> use a horcrux only for the most important logins - your social media, bank accounts etc. Am I the only person who does a huge double take on this? If someone hacks a facebook or a twitter - what precisely am I scared of? My bank accounts are literally my net worth. If they get hacked I'm broke. Why would I want a particularly strong password on Twitter or Facebook or Linkedin for that matter

Probably because (too) many people use them as OIDC providers for many other sites. "Log in with..." &c.

Re: Double Blind Passwords a.k.a. Horcruxing

#144

Post by webmaven » Tue, Dec 22, 2020, 5:00 PM UTC

molszanski wrote: post #128

webmaven wrote: post #127

Earlier quoted context omitted.

> A horcrux is a plot device where the protagonists need 2fa to send a HUP or TERM to the misbehaving process. Okay, I didn't literally LOL, but you did earn a really big grin and even a chortle. Well done. BTW, I would totally read "Harry Potter and the Protocols of Security". Some of the "Methods of Rationality" fan fiction by Eliezer Yudkowsky nods in that direction (eg. the Death Eaters' opsec).

I've heard good things about "Methods of Rationality". Worth reading?

I think so, particularly if you've read Rowling's books and were annoyed by many of the protagonists and supporting characters for a variety of reasons.

If nothing else, "Methods" succeeds in giving agency to more characters, including the villains (not necessarily to their, or Harry's, benefit), and explores/tests the "system" of magic in more depth.

Re: Double Blind Passwords a.k.a. Horcruxing

#145

Post by ds » Tue, Dec 22, 2020, 5:05 PM UTC

The best password manager would be a physical device which requires a tap to unlock a password.

Trezor password manager got close, but it seems like they abandoned it and they never supported local (sd card) storage.

Basically, It would be a yubikey style device, secured by a master password. You could have nice browser plugins for listing all your available passwords and single click logins, etc.. Everything that lastpass/1password does from a UI standpoint.

The difference would be that decrypting/unlocking passwords would require you to physically tap on the device each time to approve the unlock- and the screen would say "Unlock password for github.com?". Basically, this system makes it impossible for some trojan remote-control virus to be able to get your passwords, even if they have your master password. The BEST they can hope for is just to sit quietly on your PC for months, slowly storing all the passwords you decide to unlock.

Alas, doesnt seem like this device is going to exist any time soon. As I said, the best bet was trezor but they dont seem to care about it anymore. Too bad, they were so close.

Re: Double Blind Passwords a.k.a. Horcruxing

#146

Post by jiveturkey » Tue, Dec 22, 2020, 5:08 PM UTC

ds wrote: post #145

The best password manager would be a physical device which requires a tap to unlock a password. Trezor password manager got close, but it seems like they abandoned it and they never supported local (sd card) storage. Basically, It would be a yubikey style device, secured by a master password. You could have nice browser plugins for listing all your available passwords and single click logins, etc.. Everything that la…

I'm building exactly that.

Trevor is a joke, security-wise. I literally laffed.

Re: Double Blind Passwords a.k.a. Horcruxing

#147

Post by jonahrd » Tue, Dec 22, 2020, 5:09 PM UTC

ds wrote: post #145

The best password manager would be a physical device which requires a tap to unlock a password. Trezor password manager got close, but it seems like they abandoned it and they never supported local (sd card) storage. Basically, It would be a yubikey style device, secured by a master password. You could have nice browser plugins for listing all your available passwords and single click logins, etc.. Everything that la…

I like this, but what about mobile? What if you borrow a friends device?

Genuine questions. I want ease-of-use and security. Is it possible?

Re: Double Blind Passwords a.k.a. Horcruxing

#148

Post by 0xCMP » Tue, Dec 22, 2020, 5:14 PM UTC

jonahrd wrote: post #147

ds wrote: post #145

The best password manager would be a physical device which requires a tap to unlock a password. Trezor password manager got close, but it seems like they abandoned it and they never supported local (sd card) storage. Basically, It would be a yubikey style device, secured by a master password. You could have nice browser plugins for listing all your available passwords and single click logins, etc.. Everything that la…

I like this, but what about mobile? What if you borrow a friends device? Genuine questions. I want ease-of-use and security. Is it possible?

On iOS is the real question/problem and it's unclear if it would be workable outside a custom app to talk to it.

From a security perspective it'd be nicer to use FIDO2 normally and approve from a device where the secure password could be entered.

Re: Double Blind Passwords a.k.a. Horcruxing

#149

Post by stevelosh » Tue, Dec 22, 2020, 5:16 PM UTC

ds wrote: post #145

The best password manager would be a physical device which requires a tap to unlock a password. Trezor password manager got close, but it seems like they abandoned it and they never supported local (sd card) storage. Basically, It would be a yubikey style device, secured by a master password. You could have nice browser plugins for listing all your available passwords and single click logins, etc.. Everything that la…

You can set this up with `pass` and a Yubikey: https://www.palkeo.com/en/blog/perfect-password-manager.html

Re: Double Blind Passwords a.k.a. Horcruxing

#150

Post by v01dlight » Tue, Dec 22, 2020, 5:24 PM UTC

Ntrails wrote: post #130

> use a horcrux only for the most important logins - your social media, bank accounts etc. Am I the only person who does a huge double take on this? If someone hacks a facebook or a twitter - what precisely am I scared of? My bank accounts are literally my net worth. If they get hacked I'm broke. Why would I want a particularly strong password on Twitter or Facebook or Linkedin for that matter

Because they are your public face online and the quickest route to your contacts. It is trivial to do immense reputation damage with access to that. Would you rather go through the hassle of getting money back after you were the victim of bank fraud, or getting respect back after someone posted hardcore porn to all your contacts or used your social media as a vector to spread a scam link?