Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Double Blind Passwords a.k.a. Horcruxing

kaizoku.dev

Post reply on HN
Print view View original

41–50 of 185 posts

Re: Double Blind Passwords a.k.a. Horcruxing

#41

Post by karlding »

busfahrer wrote: post #39
emmanueloga_ wrote: post #7

This is a cool/useful idea. I thought the article was gonna be about "Shamir's Secret Sharing" [1], "where a secret is divided into parts, giving each participant its own unique part. To reconstruct the original secret, a minimum number of parts is required.". Sounds horcruxy to me :-p. I learnt about it from the PIM book [2]. 1: https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing 2: https://pimbook.org/

Is this related to that one algorithm where 3 people can find out who makes the most money without any of them knowing what the other makes, and without consulting a 4th person? That one always felt like black magic to me.

I believe you're thinking of Yao's Millionaires' problem [0].

[0] https://en.wikipedia.org/wiki/Yao%27s_Millionaires%27_proble...

Re: Double Blind Passwords a.k.a. Horcruxing

#42

Post by GoblinSlayer »

Thorrez wrote: post #28

If there's generic malware that's targeting your password manager, then yes this provides protection against that. But it doesn't provide protection against a targeted attack, because the malware can just keylog your horcrux. Another weakness that doesn't require a keylogger, is the attacker might be able to find some stolen database of a website that stored passwords in plaintext, then deduce your horcrux from the d…

>And if no password databases are available, the attacker can create a website and ask you to join it under the hope you'll reuse your horcrux on the attacker's site.

Some sites email your password to you: https://plaintextoffenders.com/

Re: Double Blind Passwords a.k.a. Horcruxing

#43

Post by tpetry »

TheDong wrote: post #19
phantom_rehan wrote: post #6

Earlier quoted context omitted.

Older and weaker hashing algorithms are probably better for this, sha384 and upwards produce large hashes that might be too big for passwords for some websites. Protonmail trims anything more than 72 characters. See - https://www.reddit.com/r/ProtonMail/comments/khrzhe/pm_ignor...

This isn't good security advice. Taking trunc(32, hex(sha512)) will still give you a result that is stronger cryptographically than taking the 32 characters hex(md5sum) would give you. For more security, you of course can encode the sha512 hash in a format other than hex in order to let those 64 bytes be fewer characters. The hex encoding is only one of many encodings. But the main point is that the solution to needi…

The problem is some websites have very old password rules like uppercase characters and symbols. So you would need a hashing function which produces these, and change the algorithm per website depending on what they allow and disallow for password characters...

Re: Double Blind Passwords a.k.a. Horcruxing

#44

Post by GoblinSlayer »

Thorrez wrote: post #32
Hackbraten wrote: post #30

Earlier quoted context omitted.

> I've actually had an attacker contact me personally (that is, actually chatting with me live) and ask me to sign up for his forum under the hope that I would reuse my valuable account's password on the forum. How did you eventually find out their true motivation?

I had one of the most valuable accounts in a video game, so attackers of all kinds were constantly contacting me. I was immediately suspicious of anyone who contacted me. I signed up for the forum with a password from my password manager (I like toying with attackers). I told him I signed up, and a few minutes later he said there was a problem with my account and asked if I used a password manager. I said yes. He sai…

All security eventually relies on obscurity, it's a bad idea to disclose your security practices. Use hunter2 as password for junk sites.

Re: Double Blind Passwords a.k.a. Horcruxing

#46

Post by chipsa »

I saw this post a while ago in a different forum. My note for it hasn't changed: This is called peppering[0]. It's a counterpart to salting, in that you add a random value to a password to make it harder to reverse the password hash, but unlike the salt, it's not stored in the password database.

0: https://en.wikipedia.org/wiki/Pepper_(cryptography)

Re: Double Blind Passwords a.k.a. Horcruxing

#49

Post by TacoSteemers »

It seems to me that this does not add a lot of security if you use the same extra word for all passwords.

It probably does add a lot of security if you use a different extra word for each password, but then you can't remember them anymore and you need to write them down somewhere.

Re: Double Blind Passwords a.k.a. Horcruxing

#50

Post by red0point »

GoblinSlayer wrote: post #44
Thorrez wrote: post #32

Earlier quoted context omitted.

I had one of the most valuable accounts in a video game, so attackers of all kinds were constantly contacting me. I was immediately suspicious of anyone who contacted me. I signed up for the forum with a password from my password manager (I like toying with attackers). I told him I signed up, and a few minutes later he said there was a problem with my account and asked if I used a password manager. I said yes. He sai…

All security eventually relies on obscurity, it's a bad idea to disclose your security practices. Use hunter2 as password for junk sites.

Can you elaborate on why all security will eventually rely on obscurity?
Post reply on HN