Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chroma-Hash: a sexy, non-reversible, live visualization of password field input

mattt.github.com

Post reply on HN
Print view View original

31–40 of 70 posts

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#31

Post by Robin_Message »

You could use a nonce when you have two password boxes, so that the two boxes match, but the hash cannot be reversed by someone who just sees the sequence.

However, this would mean the hash is different each time, so it would be no good for confirming your password is correct before you login. For the registration case, just show a tick when the fields are equal. Or just wait for the round-trip, it's not that bad.

Frankly, the last month's talk about improving password fields is boring: it doesn't need doing. I type passwords without thinking, about twice the speed I type normally, and I don't make mistakes.

Something I'd like to see a password plugin/script that hashes my password with the site URL, so if they lose my password, its not my password they lose, its a site specific hash - anyone know of one?

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#32

Post by calambrac »

heroin wrote: post #16

I do not have time to read the code. But if the colors are generated using one way hash, this would be great to have on every site. Using of colors can be replaced by showing the hash in plain text. Everybody would remember their password colors, and typos in password would be history.

Thanks gods we finally have a security-compromising solution to the world-stopping problem of typos in passwords.

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#34

Post by calambrac »

dbz wrote: post #2

I really like that- it would be nice to see that become popular for inputting passwords. It's a nice way to check to see if your confirmed password is the actual password; Furthermore, it might even help one generate more complex passwords because he or she might want a certain set of colors.

Think on that statement for a moment. If you wanted a particular set of colors for your password, and then you could turn around and actually come up with that password... see the problem? Hint: 'non-reversible'.

This idea, in its current form, sucks. It's not as bad as what you're suggesting, but it comes close - as has been pointed out by many others, if you can watch the colors change with each keystroke, you can pretty much trivially recover the password.

And it's just unnecessary. Password typos are not some huge problem begging for a solution. If you need quick confirmation of matching passwords, just compare the two fields directly, raise a warning icon if they don't match and a checkmark if they do, and be done with it. You'll even save your users a few brain cycles comparing colors.

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#35

Post by calambrac »

zzzmarcus wrote: post #4
upinsmoke wrote: post #3

Looks nice, but what about people who are colorblind?

What about them? Things continue to work as normal for the colorblind. This is just a visual aid, not a new method.

Um, what? The old method is a warning symbol or a checkmark to ensure the password fields match. Replacing that nice, intuitive, more accessible feature with this would be, excuse me, retarded. And it's not just colorblind people who would suffer. Do you really want to spend brain cycles trying to figure out if you're looking at the same shade of blue?

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#36

Post by calambrac »

extension wrote: post #29
nailer wrote: post #10

I don't see the utility of this compared to simply showing 'passwords are identical / not yet identical' live. Perhaps I'm missing something. OK, so a user makes a mistake, and they notice their n characters in the first field and their n characters in the second field generate different colors. How does this help them determine which of the two fields has what they intended to enter? Also since the user types each f…

I presume that the intended purpose of this is to give better feedback for a password challenge. I'm not sure why there is a confirm field in the demo. Perhaps to show that the color is consistent. It helps in that it lets the user know that the password is wrong the instant they've finished typing it, which might be a nice touch if it takes a long time to verify a password. They still don't know where the mistake is…

So the big win of this feature is that users might get their color combo burned into their head, and submit fewer bad passwords to the server when they bother to manually enter their password and take the time to look at and process the given colors.

Wow.

Is there a Nobel Prize for web design yet?

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#37

Post by calambrac »

NyxWulf wrote: post #20

As others have noted, this is not "non-reversible", at least in the current incarnation. Part of the problem is that if you type an 'a' you always get the same three color triplet. It seems to me that the simplest fix would be to add something like a seed value to the input or the triplet colors and then randomly generate the seed each time the page is loaded. At that point someone replaying or recording the colors w…

The two "benefits", both of which I think are bullshit, are supposed to be: you know when masked passwords match, and you recognize that you've correctly typed your password in the future. The former case usually only happens for signup or password change, and is more easily, intuitively, and accessibly handled with explicit 'matches/doesn't match' symbols. The latter case (again, which I think is bullshit) would be completely obviated by your proposal.

This is just A Bad Idea.

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#38

Post by amanfredi »

Robin_Message wrote: post #31

You could use a nonce when you have two password boxes, so that the two boxes match, but the hash cannot be reversed by someone who just sees the sequence. However, this would mean the hash is different each time, so it would be no good for confirming your password is correct before you login. For the registration case, just show a tick when the fields are equal. Or just wait for the round-trip, it's not that bad. Fr…

Someone at my company looked at password requests last week, and it looks like about 50% of login attempts fail.

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#39

Post by calambrac »

MaMa wrote: post #14
paulgb wrote: post #7

Cool, but still vulnerable to attack by someone who can record video (or with really good memory). Even though the visualization is taken from a relatively small set of three-colour triplets, an attacker who has seen the visualization for every prefix of the password has enough information to figure out the password in linear time.

There could be a little animation or delay before showing the final "hash". Only the colors for the complete password are important. And if somebody can take video of the screen they could take video of the keyboard too, no?

Um, what? It's not like you have to be an attacker to want to film someone using a computer screen. You've never seen a Google Tech Talk? You've never been to a conference?

Re: Chroma-Hash: a sexy, non-reversible, live visualization of password field input

#40

Post by nollidge »

calambrac wrote: post #35
zzzmarcus wrote: post #4

Earlier quoted context omitted.

What about them? Things continue to work as normal for the colorblind. This is just a visual aid, not a new method.

Um, what? The old method is a warning symbol or a checkmark to ensure the password fields match. Replacing that nice, intuitive, more accessible feature with this would be, excuse me, retarded. And it's not just colorblind people who would suffer. Do you really want to spend brain cycles trying to figure out if you're looking at the same shade of blue?

It's not very well presented in the demo (there's no need for the Confirm inputbox), but the point is not for password creation, but for login. From the author's github page (http://github.com/mattt/Chroma-Hash/tree/master): Chroma-Hash displays a series of colored bars at the end of field inputs so you can instantly see if your password is right... Your password will display the same sequence each time, so you can learn to expect "blue, red, pink", for instance; if you instead see "green, purple, yellow", you'll know you typed it wrong.

So the chromatically-impaired will not lose anything over current functionality, they just won't get the benefit.

Post reply on HN