Chroma-Hash: a sexy, non-reversible, live visualization of password field input

Post by Torn » Wed, Jul 29, 2009, 8:37 AM UTC

chaosmachine wrote: post #11

This is pretty, but non-reversible it isn't. The colors update with every keystroke, making it easy to determine letter by letter, which keys are being pressed. This is a significant hole in many situations (screencasts, recorded presentations, or anywhere someone can point a camera at your screen). Simple fix: Wait for 300ms of keyboard inactivity before computing the colors. This way you only get the colors when th…

Post by Huppie » Wed, Jul 29, 2009, 9:02 AM UTC

codyrobbins wrote: post #21

nailer wrote: post #10

I don't see the utility of this compared to simply showing 'passwords are identical / not yet identical' live. Perhaps I'm missing something. OK, so a user makes a mistake, and they notice their n characters in the first field and their n characters in the second field generate different colors. How does this help them determine which of the two fields has what they intended to enter? Also since the user types each f…

Agreed — I don't understand how this is much help. Furthermore, it was confusing to me until I understood what it was doing, and — when I did — I similarly thought, 'Why isn't it just telling me when the passwords match?' Your average user is going to be completely perplexed by this and have no idea what it's even for. I would argue that this is far less usable for the average user than the old-fashioned implementati…

Post by jballanc » Wed, Jul 29, 2009, 9:03 AM UTC

nailer wrote: post #10

I don't see the utility of this compared to simply showing 'passwords are identical / not yet identical' live. Perhaps I'm missing something. OK, so a user makes a mistake, and they notice their n characters in the first field and their n characters in the second field generate different colors. How does this help them determine which of the two fields has what they intended to enter? Also since the user types each f…

Post by Torn » Wed, Jul 29, 2009, 9:14 AM UTC

chaosmachine wrote: post #25

Torn wrote: post #22

Earlier quoted context omitted.

I don't see how this follows -- the colours are changing with each keypress (just as an md5 digest would change if you added a letter to the message) but surely you cannot know the key pressed without brute-forcing / breaking the hash, which is computationally impractical? He's also scraping the hash for a run of 6 hex characters, so surely there's quite a few colour collisions for different hashes, making it even ha…

Because you can see the color code at each step, it's easy to compare results very quickly, even by hand. Did I get letter 1 right? Ok, move on to letter two, try each key until the colors match the recording. Do this for each step. At most, you have to try about 64 key presses to crack each letter. Also, because each step is only 1 character different, it's very unlikely that you will get collisions, even with a tru…

Post by jay_kyburz » Wed, Jul 29, 2009, 10:42 AM UTC

Huppie wrote: post #24

codyrobbins wrote: post #21

Earlier quoted context omitted.

Agreed — I don't understand how this is much help. Furthermore, it was confusing to me until I understood what it was doing, and — when I did — I similarly thought, 'Why isn't it just telling me when the passwords match?' Your average user is going to be completely perplexed by this and have no idea what it's even for. I would argue that this is far less usable for the average user than the old-fashioned implementati…

The idea behind this program is probably not to show you when your passwords 'match' but to show you whether your password is correct. E.g. If you see the colors of your password everytime you log in, you will probably learn that your password is correctly typed if you see the colours purple-green-olive. Whenever you spell your password incorrect (and thus see 'blue-pink-black' for instance) you will notice it immedi…