Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Double Blind Passwords a.k.a. Horcruxing

kaizoku.dev

Post reply on HN
Print view View original

161–170 of 185 posts

Re: Double Blind Passwords a.k.a. Horcruxing

#161

Post by webmaven »

inetsee wrote: post #155
webmaven wrote: post #144

Earlier quoted context omitted.

I think so, particularly if you've read Rowling's books and were annoyed by many of the protagonists and supporting characters for a variety of reasons. If nothing else, "Methods" succeeds in giving agency to more characters, including the villains (not necessarily to their, or Harry's, benefit), and explores/tests the "system" of magic in more depth.

>> and explores/tests the "system" of magic in more depth. I particularly liked the section where Harry is trying to find out how magic "works". He starts with the gross physicalities: the materials the wands are made of, the sounds of the recited spells. He ends up with the mathematics underlying physics, learning how to create new spells. He uses his new found knowledge to create a very powerful weapon spell he use…

I liked the exposure of the DWIMian (rather than strictly Newtonian) physics of flying broomsticks, although it should be noted that the DWIMian behavior is based on the physics of low-speed high-friction ground transportation rather than a sourceless 'intuition' the author blames.

Re: Double Blind Passwords a.k.a. Horcruxing

#162

Post by buzzerbetrayed »

melonkidney wrote: post #102
_wldu wrote: post #88

I wrote a program to generate passwords based on user input about 10 years ago. I still use it today and a few teams I have worked with still use it. I called it DPG. Deterministic Password Generator. It is a similar concept. I have implemented it in Go, C++, Java and Python. I wish the idea of generating passwords when needed rather than storing and retrieving them was more popular. Traditional password Managers are…

Around 5 years ago I wrote something very similar, for the same reasons as you. It was never intended to be more than a proof of concept, but I've ended up using it most every day. Mine is web based, but all implemented in the front-end; no data is ever sent to the server. I was debating whether to post the URL, because I don't really want a bunch of people to start depending on it the way I do (I have zero plans to…

> Your verification code is 120179. You can use it to verify your seed password in the future.

What does this mean? And how is it used to verify a password?

Re: Double Blind Passwords a.k.a. Horcruxing

#163

Post by CharlesMerriam2 »

This can be a useful idea, requiring a checkbox on password managers, e.g., "[ ] Pause for additional input".

No one ever answers how often security breaks are from: passwords being guessed, brute forced, or shared; client side compromise from malware, keyloggers, and first-hop IP session takeover; or server side compromise from poor custom code and poor infrastructure choices. Anecdotally, the chart leans to the server side security breaches.

In the absence of knowledge, we get two security talks repeated over and over. This is the first: do a better job with passwords. The second is "You are irrovacably insecure because of [some issue], but update your passwords regularly."

Security has not developed a reputation for being a craft or science.

Re: Double Blind Passwords a.k.a. Horcruxing

#164

Post by tgb »

kbenson wrote: post #156
tgb wrote: post #129

Earlier quoted context omitted.

I think these concepts are significantly different - as different as salts and peppers at least. Peppering helps protect against database access revealing password. Horcrux protects against password manager access. Peppering is stored on the server, but outside the database. Horcruxes are stored in the user's head. You could do both, one, or neither. Client-side peppering would be having part of your password outside…

> Peppering helps protect against database access revealing password. Horcrux protects against password manager access. What is a password manager but a database of your passwords? Peppering is a token that is not in the database of passwords that needs to be applied for the password to be correct. Whether it's applied by an application, or a person doesn't seem relevant, as what is an application but a set of instru…

Frankly this has more in common with a 2FA approach with one factor being the password manager and the other your horcrux. I wouldn't call my phone authenticator app a client-side pepper.

Re: Double Blind Passwords a.k.a. Horcruxing

#165

Post by heleninboodler »

CharlesMerriam2 wrote: post #163

This can be a useful idea, requiring a checkbox on password managers, e.g., "[ ] Pause for additional input". No one ever answers how often security breaks are from: passwords being guessed, brute forced, or shared; client side compromise from malware, keyloggers, and first-hop IP session takeover; or server side compromise from poor custom code and poor infrastructure choices. Anecdotally, the chart leans to the ser…

> No one ever answers how often security breaks are from: passwords being guessed, brute forced, or shared; client side compromise from malware, keyloggers, and first-hop IP session takeover; or server side compromise from poor custom code and poor infrastructure choices.

It's really hard to get those guys to fill out questionnaires.

Re: Double Blind Passwords a.k.a. Horcruxing

#166

Post by kortex »

inopinatus wrote: post #120
vmarquet wrote: post #70

Earlier quoted context omitted.

I think the term "peppering" is mostly used for server side manipulation of the password, which the user is unaware of. It would be very confusing to reuse this term for what is described in this article, so a new term like "Horcruxing" can be relevant. I like it.

I fear it may be unfair to expect most end-users to apply this scheme appropriately and consistently, and therefore recommend that it be known as mustard .

I was thinking currying, as it is both spice-themed and analogous to function currying in that you take your base password, curry it with the secret to get the submitted password.

Re: Double Blind Passwords a.k.a. Horcruxing

#167

Post by kortex »

emmanueloga_ wrote: post #7

This is a cool/useful idea. I thought the article was gonna be about "Shamir's Secret Sharing" [1], "where a secret is divided into parts, giving each participant its own unique part. To reconstruct the original secret, a minimum number of parts is required.". Sounds horcruxy to me :-p. I learnt about it from the PIM book [2]. 1: https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing 2: https://pimbook.org/

Shameless plug: I've been working on this utility to facilitate sharding keys/passwords so you can set up your own password recovery schemes:

https://github.com/xkortex/passcrux

It's more horcrux-y than TFA in that you need N of M shards to reconstruct. TFA isn't really a horcrux, since there's a 100% dependency on each part of the full password.

Canon doesn't specify how many horcruxes he needs to be reanimated, but we know there is some redundancy due to the loss of the diary.

Re: Double Blind Passwords a.k.a. Horcruxing

#168

Post by upbeat_general »

Thorrez wrote: post #28

If there's generic malware that's targeting your password manager, then yes this provides protection against that. But it doesn't provide protection against a targeted attack, because the malware can just keylog your horcrux. Another weakness that doesn't require a keylogger, is the attacker might be able to find some stolen database of a website that stored passwords in plaintext, then deduce your horcrux from the d…

True but all of the methods you mention to determine the horcrux are also ways to get someone's typical password, so password manager + horcrux is still much stronger as you need both (besides obviously the keylogger/malware).

You could also just have a horcrux for a couple sites and make them all distinct obviously.

Re: Double Blind Passwords a.k.a. Horcruxing

#169

Post by warmwaffles »

thyrsus wrote: post #135

My bank uses some kind of mandatory javascript malware to make it impossible to paste or password-manage the password they demand. I'm beginning to see this on an increasing number of sites. Even if I could find out which banks don't make this particular offering to Satan, what would prevent the bank I switch to from adopting this malfeasance next week?

Yes this is the most annoying thing to deal with. From my experience these sites block pasting values. I use Don't Fuck With Paste [0] [1]

[0] https://chrome.google.com/webstore/detail/dont-fuck-with-pas...

[1] https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-wi...

Re: Double Blind Passwords a.k.a. Horcruxing

#170

Post by GoblinSlayer »

Dylan16807 wrote: post #62
GoblinSlayer wrote: post #42

Earlier quoted context omitted.

>And if no password databases are available, the attacker can create a website and ask you to join it under the hope you'll reuse your horcrux on the attacker's site. Some sites email your password to you: https://plaintextoffenders.com/

With two important notes: 1) A site that emails you your password might not be storing it in plain text. They're similar but separate problems. 2) A site that sends you a login link could be just as bad as the sites listed here, if that login link doesn't expire (and you used a unique password). It's a more subtle way of having the same problem.

Many sites are wrongly listed there, like https://plaintextoffenders.com/post/629608281322733568/qnx-s...
Post reply on HN