Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using Ordered Markov Chains and User Information to Speed Up Password Cracking

fsecurify.com

Post reply on HN
Print view View original

41–50 of 64 posts

Re: Using Ordered Markov Chains and User Information to Speed Up Password Cracking

#41

Post by landryraccoon »

Buge wrote: post #40
__ddd__ wrote: post #36

Earlier quoted context omitted.

Random pass phrases written in uv marker on the underside of your desk, in a notebook (bonus: you can burn it once memorized) scrambled and/or hidden among decoy passphrases. Make the phrase long enough (high enough entropy) that you have enough time to memorize it and use it before it should be rotated. Whether you like this implementation or not, the solution is to choose better passwords.

If your house burns down, you lose your passwords. If somemone (burglar / law enforcement / intelligence agencies) breaks in, they have your passwords. If you are memorizing a lot of passwords (I have 500+ in my password database) you are surely going to forget rarely used ones. If passwords are written down, they can be demanded from you by a warrant/court order. If they are memorized, they cannot.

Cracking a piece of paper can't be automated. A human being has to break in and find and steal it. Most of us are high value enough for a script kiddie to want to steal our credit card numbers, few of use are valuable enough for someone to break into our home just to look for a password.

If your passphrase is an innocuous phrase, like "red dogs like spicy food", how will they you know you have a password to demand? How do they know you have a piece of paper instead of having it memorized?

Re: Using Ordered Markov Chains and User Information to Speed Up Password Cracking

#42

Post by home_boi »

__ddd__ wrote: post #36
eikenberry wrote: post #34

Earlier quoted context omitted.

What password management solution doesn't have this aspect?

Random pass phrases written in uv marker on the underside of your desk, in a notebook (bonus: you can burn it once memorized) scrambled and/or hidden among decoy passphrases. Make the phrase long enough (high enough entropy) that you have enough time to memorize it and use it before it should be rotated. Whether you like this implementation or not, the solution is to choose better passwords.

Not sure if serious, but pragmatically speaking, you would be better off with a locked down laptop that never touches a network with offline Keepass that was installed through a USB.

Re: Using Ordered Markov Chains and User Information to Speed Up Password Cracking

#43

Post by Buge »

landryraccoon wrote: post #41
Buge wrote: post #40

Earlier quoted context omitted.

If your house burns down, you lose your passwords. If somemone (burglar / law enforcement / intelligence agencies) breaks in, they have your passwords. If you are memorizing a lot of passwords (I have 500+ in my password database) you are surely going to forget rarely used ones. If passwords are written down, they can be demanded from you by a warrant/court order. If they are memorized, they cannot.

Cracking a piece of paper can't be automated. A human being has to break in and find and steal it. Most of us are high value enough for a script kiddie to want to steal our credit card numbers, few of use are valuable enough for someone to break into our home just to look for a password. If your passphrase is an innocuous phrase, like "red dogs like spicy food", how will they you know you have a password to demand? H…

They can court order you to produce all relevant documents. They don't have to know that the document exists to order you to do it. You could lie to the court that the document doesn't exist, but I wouldn't recommend that.

Re: Using Ordered Markov Chains and User Information to Speed Up Password Cracking

#44

Post by GrayShade »

lqdc13 wrote: post #26
lucb1e wrote: post #17

Earlier quoted context omitted.

It is now: blank response with status code 500.

Always baffling to me. HN front page is not that much traffic. Maybe 1 req/s on avg for a few hrs with bursts up to 3 req/s.

Why are you getting downvoted?

Re: Using Ordered Markov Chains and User Information to Speed Up Password Cracking

#45

Post by ultrahate »

Is there precedent that shows that adding restrictions to passwords is dangerous? For example, I use a multi word password for most things, and sometimes it makes me add uppercase or numbers. The average persons password transform just based on that information is probably vulnerable to a sophisticated attack. If I knew a certain site required a certain schema, I could more accurately guess how a user would change their password based on those requirements.

Re: Using Ordered Markov Chains and User Information to Speed Up Password Cracking

#46

Post by __ddd__ »

Buge wrote: post #43
landryraccoon wrote: post #41

Earlier quoted context omitted.

Cracking a piece of paper can't be automated. A human being has to break in and find and steal it. Most of us are high value enough for a script kiddie to want to steal our credit card numbers, few of use are valuable enough for someone to break into our home just to look for a password. If your passphrase is an innocuous phrase, like "red dogs like spicy food", how will they you know you have a password to demand? H…

They can court order you to produce all relevant documents. They don't have to know that the document exists to order you to do it. You could lie to the court that the document doesn't exist, but I wouldn't recommend that.

Well if you're willing to compromise on security by trusting a password manager / encrypted volume (plus user opsec) to store your passwords, there are other compromises one can make to facilitate easier memorization. Security by obscurity is a worthless feature when designing a cryptographic system, but it is an invaluable tool for your own personal opsec. Reuse some passwords for services with a lesser threat model, with slight changes. Is it sub-optimal? Sure, but so is trusting a black box program with your passwords, probably running on your everyday (read: unsecure) computer. As your parent noted, you can't automate low tech cryptanalysis, and you're really not that important.

Re: Using Ordered Markov Chains and User Information to Speed Up Password Cracking

#47

Post by ma2rten »

gwern wrote: post #35
ma2rten wrote: post #32

Earlier quoted context omitted.

Actually RNNs/LSTMs are surprisingly good at memorizing in addition to generalization. Have a look at the famous blog post "The Unreasonable Effectiveness of Recurrent Neural Networks" [1] for instance and notice how many words it's able to generate from characters. However, your second point is valid. [1] http://karpathy.github.io/2015/05/21/rnn-effectiveness/

That's not 'surprisingly' good, that's effective only on a small corpus. You can see for yourself that if you try to feed it multiple corpuses with many vocabulary words or proper names, which a Markov chain wouldn't break a sweat on memorizing them all, the RNN has limited memorization ability and what tends to happen is that the less common ones get overwritten in favor of the general grammar of English and the voc…

If I understand you correctly you are comparing Markov Chains on words to a RNN over characters. That's not fair.

This paper shows a large LSTM outperform n-gram models:

"In this paper we have shown that RNN LMs can be trained on large amounts of data, and outperform competing models including carefully tuned N-grams. [...] Unlike previous work, we do not require to interpolate both the RNN LM and the N-gram, and the gains of doing so are rather marginal."

https://arxiv.org/abs/1602.02410

Re: Using Ordered Markov Chains and User Information to Speed Up Password Cracking

#48

Post by gwern »

ma2rten wrote: post #47
gwern wrote: post #35

Earlier quoted context omitted.

That's not 'surprisingly' good, that's effective only on a small corpus. You can see for yourself that if you try to feed it multiple corpuses with many vocabulary words or proper names, which a Markov chain wouldn't break a sweat on memorizing them all, the RNN has limited memorization ability and what tends to happen is that the less common ones get overwritten in favor of the general grammar of English and the voc…

If I understand you correctly you are comparing Markov Chains on words to a RNN over characters. That's not fair. This paper shows a large LSTM outperform n-gram models: "In this paper we have shown that RNN LMs can be trained on large amounts of data, and outperform competing models including carefully tuned N-grams. [...] Unlike previous work, we do not require to interpolate both the RNN LM and the N-gram, and the…

> If I understand you correctly you are comparing Markov Chains on words to a RNN over characters. That's not fair.

No. Words have nothing to do with it. (An RNN over words would be useless for password guessing.)

Anyway, your link doesn't demonstrate what you think it demonstrates. It's not on a password corpus but a much smaller natural language one, there is no attempt to equate runtime or model size, and the log-likelihood is an irrelevant measure of performance to passwords/s.

Re: Using Ordered Markov Chains and User Information to Speed Up Password Cracking

#50

Post by swixmix »

eikenberry wrote: post #34
mattcoles wrote: post #28

Earlier quoted context omitted.

It's still a single point of failure if the password manager is compromised.

What password management solution doesn't have this aspect?

Use your favorite password manager and create your passwords using https://www.eff.org/dice
Post reply on HN