Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

networkworld.com

Post reply on HN
Print view View original

81–90 of 96 posts

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#81

Post by smellf »

Someone wrote: post #78
nicwolff wrote: post #76

Earlier quoted context omitted.

Why not, since you're only storing a fixed-length hash of the password?

Some browsers might not want to send the password in a POST request. Effect could be that you can change your password from browser X, but cannot login later from a different browser or after you upgraded that browser. If you are really unlucky, the browser you change it from chops off characters from the password. Also, chances are users will not type their 10MB password into an input field, but try and paste it in.…

Shouldn't the password be hashed on the frontend anyway...?

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#82

Post by smellf »

profinger wrote: post #73
GrinningFool wrote: post #61

Earlier quoted context omitted.

Maximum length tops my list of favorite restriction, because it strongly suggests that they're keeping my password in the clear somewhere - or they used to, and just never got around to changing it. The concept of illegal characters is tied for second. If you're handling it right, there should be no such thing - yet so many sites continue to set arbitrary limitations for reasons that aren't clear even to them. Kind o…

I agree and was just complaining about this to a coworker. I tried to use a passphrase somewhere, I think paypal? and it made me make my password between 6-10 characters...

A few months ago I set up an account with American Express. I was able to log in to their website from a desktop, but the Android app wouldn't let me log in. Eventually I would up talking with their tech support, having been elevated twice, and I learned that their passwords are limited to 20 characters, as well as NO UPPERCASE CHARACTERS! For some reason, I had been able to make my long, uppercase-filled password on the desktop site, but the app was lower()ing and truncating my password.

To add insult to injury, when I tried to tell the gentleman on the line what an egregious security lapse this was, he cut me off with a terrifying and patronizing explanation: "strong passwords don't matter anymore, because nowadays we have _encryption_".

American Express, get fucking real.

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#83

Post by raverbashing »

mikeash wrote: post #68
raverbashing wrote: post #15

Earlier quoted context omitted.

Password managers have a central point of failure, either it's breached or its password/data is lost I can trust a password manager, but I would keep an offline physical backup, and they're not the 'ultimate solution'

What's the central point of failure for my 1Password vault? It's stored on four of my devices. It's stored on Dropbox as well, but a compromise of Dropbox won't give the attacker anything because it uses secure crypto and I have a strong master password.

The central point of failure is: you losing your master password

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#84

Post by recursive »

smellf wrote: post #81
Someone wrote: post #78

Earlier quoted context omitted.

Some browsers might not want to send the password in a POST request. Effect could be that you can change your password from browser X, but cannot login later from a different browser or after you upgraded that browser. If you are really unlucky, the browser you change it from chops off characters from the password. Also, chances are users will not type their 10MB password into an input field, but try and paste it in.…

Shouldn't the password be hashed on the frontend anyway...?

No. If you do that, then the password hash becomes the real password, and the exercise of hashing it serves no security purpose.

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#85

Post by mikeash »

raverbashing wrote: post #83
mikeash wrote: post #68

Earlier quoted context omitted.

What's the central point of failure for my 1Password vault? It's stored on four of my devices. It's stored on Dropbox as well, but a compromise of Dropbox won't give the attacker anything because it uses secure crypto and I have a strong master password.

The central point of failure is: you losing your master password

Is there any secure scheme that protects against that sort of major brain failure?

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#86

Post by raverbashing »

mikeash wrote: post #85
raverbashing wrote: post #83

Earlier quoted context omitted.

The central point of failure is: you losing your master password

Is there any secure scheme that protects against that sort of major brain failure?

Not that I'm aware of, it's definitely not simple A lot relies on being able to "forget password" on systems

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#87

Post by rahimnathwani »

nr152522 wrote: post #32
rahimnathwani wrote: post #30

Earlier quoted context omitted.

A face is a username, not a password. I can take a picture of you and hold it up in front of the webcam. And my picture will work every time unless you decide to get surgery.

Exactly,...the user is identified and then requested to enter a password. You are identifying the user, then you proceed to ask them a password. I.e. Identifying the user is something you are, then asking them for a password is something you know.

There's no improvement in security from asking for a face rather than a username.

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#88

Post by ap22213 »

jeremysmyth wrote: post #4

This method fails as soon as you have to change a password: - One of the sites is compromised - One of your devices is stolen/lost and you have to change some passwords - One of the sites has a password expiration policy Pretty soon you end up with multiple password schemes and you're in precisely the same situation as before, wondering which password goes with which site, only this time you have to perform algorithm…

It's not all that bad, seriously. I've been using an algorithm-based scheme across probably hundreds of sites for probably 10 years.

There are 3 'tricks':

1. First, use several different initial functions for different levels of security, each with different levels of complexity (i.e. f1(user,domain), f2(user,domain), etc).

2. Then, use a function for password requirement rules (i.e. g(f(user,domain),rules)).

3. Finally, use a final function for rotating passwords (i.e. h(g(f(user,domain),rules),rotation)).

So, all together, maybe 5 different algorithms, each of different levels of complexity.

You'd think that this would be very difficult to manage, but it hasn't been in practice. Very, very few times do I pick the wrong initial algorithm when trying to derive my password. And, in that case, I can quickly iterate to the correct password within 3-4 tries.

Most of the time I get it on the first try. Sometimes, I get it on the 2nd-3rd try. Very, very rarely (< 1%), I cannot derive it within 5 tries. And, at that point, I just do a password reset (and rotate the password using the h function).

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#89

Post by wingerlang »

jjoonathan wrote: post #45
wingerlang wrote: post #33

Earlier quoted context omitted.

As someone who has used passwords based on the website names for a long time, this has been an issue maybe 3 times, in total.

How long is "a long time"? Because over the year or so I gave sitename-passwords a try it popped up as an issue way more than 3 times, even after I started ignoring subdomains and instituted rules about always trying to use the main domain for big companies. There are tons of systems out there that use cross-domain (notably both of my banks and both of my schools), hidden-domain (i.e. log into an app or device where…

I've used it for probably 6-8 years now, first memory of the base password is well around 10 years.

It is not very strong, I don't have some lookup table or complicated stuff just some small variations for each site.

I've started using 1Password as of late though, but that's mainly because I sometimes want to store notes and whatnot for websites and this makes that convenient.

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#90

Post by nr152522 »

rahimnathwani wrote: post #87
nr152522 wrote: post #32

Earlier quoted context omitted.

Exactly,...the user is identified and then requested to enter a password. You are identifying the user, then you proceed to ask them a password. I.e. Identifying the user is something you are, then asking them for a password is something you know.

There's no improvement in security from asking for a face rather than a username.

What are the reasons? Genuinely interested as I'd like to understand in more detail.
Post reply on HN