Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lessons from a Professional Password Cracker

themarkup.org

Post reply on HN
Print view View original

71–80 of 138 posts

Re: Lessons from a Professional Password Cracker

#71

Post by Aachen »

astrange wrote: post #69
lucb1e wrote: post #64

Earlier quoted context omitted.

What I'm hearing you say is that the hardware has baked-in private keys. That is not biometrics, that's public-private key authentication. People already do this with ssh/pgp private keys on a hardware token. Which is a good idea, but it has nothing to do with biometrics and is not something you need to sell your soul to apple for. > It’s also more secure than a password on a phone because if you’re using it in publi…

> What I'm hearing you say is that the hardware has baked-in private keys. That is not biometrics, that's public-private key authentication. Even if you could write your sensor's face data into someone else's phone, you still wouldn't be able to authenticate with it, because it doesn't have the same sensor. It's not just different keys, the fixed layout of the IR pattern is different. > I'd rather hold a hand over a…

I don't think they meant respiratory masks to hide from your head being scanned, especially if the algorithm doesn't look at that part of your head.

> Even if you could write your sensor's face data into someone else's phone,

Since the keys presumably aren't retrievable from the hardware, it doesn't matter if there are random or intentional production flaws in the sensor itself: you need the original hardware anyway. You just need to trick it into doing the authentication. That's the part where biometrics are involved, the part where you present it with a username so to say. The rest is private key authentication.

Re: Lessons from a Professional Password Cracker

#72

Post by 2Gkashmiri »

vladvasiliu wrote: post #53
2Gkashmiri wrote: post #50

Earlier quoted context omitted.

i am forced to use windows machines in my own office. i know people and kids who use windows machines. with new installs, they are being taught to set a password, which is fine for a bank or a super secure machine that holds financial data but for kids and grannies and drone office workers, this gets tiring. Now you are saying to FORCE them to use 14+ characters. HOW? why? in linux there is a "auto login with this pa…

Because with more and more people having laptops, they probably don't want their pictures or what have you in the hands of some random thief who happened to steal it. Newer computers also usually come with a TPM, which allows you to not have to type the password every time. If the PC doesn't have a fingerprint reader [0], it can use a shorter PIN. --- [0] I know a fingerprint isn't a password, but for protecting low-…

the thief can just use a live cd and copy stuff, i mean that is what i do when i bork the windows install. i don't use bitlocker and i suspect many many people don't so this is merely an inconvenience

Re: Lessons from a Professional Password Cracker

#73

Post by elevaet »

maxbond wrote: post #28
gmane wrote: post #17

Hey, I keep seeing people claim biometrics somehow fix the password problem, but I feel like this is just a password you can't change? I can't change my fingerprints nor my retina, but if that data ever gets leaked, then that's vulnerable forever? In my mind, there's no world where one could make a biometric scanner that couldn't be spoofed (presumably with an arduino USB interface) and then when all these corporatio…

I can't remember who to credit for this quote, "fingerprints are usernames, not passwords."

Zing! That's excellent.

Re: Lessons from a Professional Password Cracker

#74

Post by jve »

gmane wrote: post #17

Hey, I keep seeing people claim biometrics somehow fix the password problem, but I feel like this is just a password you can't change? I can't change my fingerprints nor my retina, but if that data ever gets leaked, then that's vulnerable forever? In my mind, there's no world where one could make a biometric scanner that couldn't be spoofed (presumably with an arduino USB interface) and then when all these corporatio…

It's a solved problem in a minor baltic state.

We have id card, which contains client authentication certificates. The procedure on acquiring ID card is the same as passport and carries the same legal power. You have to show up in real life and they take your fingerprints, photo and issue you ID card. ID cards will actually be mandatory for everyone beginning 2023-01-01 - up until now they are optional but very much favored around my circle. There is a fair amount of stuff you can only do with ID card (remotely):

- Set up smart-id for 2FA for banking app in your smartphone. No, I don't have option not to use 2FA.

- Official communication with .gov entities.

- Signature & timestamp service

- Remote notary services (requires video presence and showing ID card additionally to actually using it to put digital signature)

- Logging in various sites (banking, government entities)

- Recovering from lost second factor at national TLD DNS registry.

This is the ultimate authentication mechanism that services use to allow you to perform so much.

To authenticate & put down signature, you must use dedicated PIN code for each of those operations. And of course you must possess the card (use card reader).

Re: Lessons from a Professional Password Cracker

#75

Post by zokier »

lofaszvanitt wrote: post #20

Yubikey is here since 2007... and Windows 10 still doesn't support passwordless, security key only! login. They want you to register a goddamn MS account too...

Windows has supported smartcard logins since at least 2000, should work fine with yubikeys too.

https://support.yubico.com/hc/en-us/articles/360013707820-Yu...

Re: Lessons from a Professional Password Cracker

#76

Post by mr_mitm »

GoblinSlayer wrote: post #68
mr_mitm wrote: post #61

Earlier quoted context omitted.

Note that cracking the NT hash rarely results in escalation of privileges due to the pass-the-hash vulnerability. There is almost never any need to crack NT hashes. The attacks you need to defend against are: 1) online password guessing, 2) Kerberoast, 3) cracking NTLMv2 authentication handshakes, 4) cracking DCCs (Domain Cached Credentials). 1) is solved by applying a moderate list of banned passwords, a sensible lo…

And guess what, in windows networks authentication is done with domain credentials, but those are bound to your physical console, so a password manager can't be used for remote authentication in this case.

What do you mean by "domain credentials are bound to your physical console"?

Re: Lessons from a Professional Password Cracker

#77

Post by MayeulC »

2Gkashmiri wrote: post #72
vladvasiliu wrote: post #53

Earlier quoted context omitted.

Because with more and more people having laptops, they probably don't want their pictures or what have you in the hands of some random thief who happened to steal it. Newer computers also usually come with a TPM, which allows you to not have to type the password every time. If the PC doesn't have a fingerprint reader [0], it can use a shorter PIN. --- [0] I know a fingerprint isn't a password, but for protecting low-…

the thief can just use a live cd and copy stuff, i mean that is what i do when i bork the windows install. i don't use bitlocker and i suspect many many people don't so this is merely an inconvenience

I think windows encrypts more and more by default.

TPMs are not unlocked if they can't validate the boot chain (live cd), so you'd need the disk password (and full user password).

Re: Lessons from a Professional Password Cracker

#78

Post by MayeulC »

jve wrote: post #74
gmane wrote: post #17

Hey, I keep seeing people claim biometrics somehow fix the password problem, but I feel like this is just a password you can't change? I can't change my fingerprints nor my retina, but if that data ever gets leaked, then that's vulnerable forever? In my mind, there's no world where one could make a biometric scanner that couldn't be spoofed (presumably with an arduino USB interface) and then when all these corporatio…

It's a solved problem in a minor baltic state. We have id card, which contains client authentication certificates. The procedure on acquiring ID card is the same as passport and carries the same legal power. You have to show up in real life and they take your fingerprints, photo and issue you ID card. ID cards will actually be mandatory for everyone beginning 2023-01-01 - up until now they are optional but very much…

I long wondered about this... How does card reading work?

Are regular smartcard readers compatible? Does the card have NFC for phones? Can you use them under Linux/mac? Do regular browsers work with it? (FIDO/webauthn).

Or is the card reader a standalone device, like my bank uses, where you key in your PIN, and it gives you a one-time code, or a response to a challenge?

Re: Lessons from a Professional Password Cracker

#79

Post by lofaszvanitt »

zokier wrote: post #75
lofaszvanitt wrote: post #20

Yubikey is here since 2007... and Windows 10 still doesn't support passwordless, security key only! login. They want you to register a goddamn MS account too...

Windows has supported smartcard logins since at least 2000, should work fine with yubikeys too. https://support.yubico.com/hc/en-us/articles/360013707820-Yu...

You need an additional MS account for login... no it doesn't work in ITSELF.

Re: Lessons from a Professional Password Cracker

#80

Post by lbriner »

hn_throwaway_99 wrote: post #18

> Instead of passwords, we should use something like FIDO, which allows users to log in using a security key or biometric information. The problem "in the real world" is that people will lose these keys all the time . I mean, I agree, passwords need to die, and hopefully some of the work that is being done by Apple and others will help bring on an end to passwords, but you can't really talk about replacing passwords…

Exactly. I asked Per Thorsheim once about resetting 2FA creds, something that is viable for banks etc. that hold a lot of semi-private data which can be used to verify your data but for a much smaller startup with basic account info.

He said he didn't know how it would be done securely.

I see a lot of attacks are due to account takeover and we currently seem torn between allowing an attacker to circumvent the 2FA by account reset or leaving someone unable to access their account for ever.

I started scanning 2FA codes into two phones, my main one and one that I leave hidden at home (and switched off) for backups. Knowing my luck though, I'll ned to access the one that I forgot to scan into the second phone!

Post reply on HN