Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Double Blind Passwords a.k.a. Horcruxing

kaizoku.dev

Post reply on HN
Print view View original

81–90 of 185 posts

Re: Double Blind Passwords a.k.a. Horcruxing

#81

Post by CGamesPlay »

waynesonfire wrote: post #37
CGamesPlay wrote: post #23

Earlier quoted context omitted.

I somewhat recently made my personal disaster recovery plan, and the password manager features prominently into it. If I lose all of my electronic devices in a sudden accident, how can I recover my online life? To address your questions specifically: 1. I used Shamir's secret sharing to send out a copy of my secret key to a few loved ones. The master password is in my memory only. If I forget the master password, I l…

How did you encode messages for (1)? Did you provide instructions? Did you keep a copy?

There's a ton of online sites for it. I used something custom, but the first result on google seems like it would work just fine. https://iancoleman.io/shamir/

I kept a copy of the combined secret... it's the secret key to my password manager. I do have a plain-text document that fully describes the steps to restore my identity, but it's addressed to myself. My goal is to get my own identity back, not to prepare for my own death.

Re: Double Blind Passwords a.k.a. Horcruxing

#82

Post by Dylan16807 »

StavrosK wrote: post #80
Dylan16807 wrote: post #57

Earlier quoted context omitted.

While it's a clever method, it's also worth noting that for moderately-sized groups you can achieve the same thing with a much simpler method and almost no math. Let's say you have a 256 bit key as the secret, and you want any 5 out of 15 people to have access. For each combination of 5 people, pick 4 random 256 bit numbers. 4 people get those and 1 gets the key encrypted with those numbers as a one time pad. Once yo…

What happens if 5 people who have encrypted random numbers (and no key) get together?

What's an "encrypted random number"?

If they have 5 random numbers and XOR them together, then they won't get the key as output.

Re: Double Blind Passwords a.k.a. Horcruxing

#83

Post by StavrosK »

Dylan16807 wrote: post #82
StavrosK wrote: post #80

Earlier quoted context omitted.

What happens if 5 people who have encrypted random numbers (and no key) get together?

What's an "encrypted random number"? If they have 5 random numbers and XOR them together, then they won't get the key as output.

So then it's not "any" 5 out of 15, it's "any group of these three", which is a significant disadvantage compared to SSS.

Re: Double Blind Passwords a.k.a. Horcruxing

#85

Post by molszanski »

chairmanwow1 wrote: post #71
vmarquet wrote: post #70

Earlier quoted context omitted.

I think the term "peppering" is mostly used for server side manipulation of the password, which the user is unaware of. It would be very confusing to reuse this term for what is described in this article, so a new term like "Horcruxing" can be relevant. I like it.

I think I really disagree with you there. This is the same concept but applied client-side instead of server-side. But “client-side peppering” won’t get you to the front page of HN..

I would click “client-side peppering” over horxsomething, didn't read Harry Potter

Re: Double Blind Passwords a.k.a. Horcruxing

#86

Post by kkirsche »

chairmanwow1 wrote: post #71
vmarquet wrote: post #70

Earlier quoted context omitted.

I think the term "peppering" is mostly used for server side manipulation of the password, which the user is unaware of. It would be very confusing to reuse this term for what is described in this article, so a new term like "Horcruxing" can be relevant. I like it.

I think I really disagree with you there. This is the same concept but applied client-side instead of server-side. But “client-side peppering” won’t get you to the front page of HN..

Agreed. A common reason for shared terminology in computing is to encourage re-use of techniques, this is a great example of that

Re: Double Blind Passwords a.k.a. Horcruxing

#87

Post by curiousllama »

l1am0 wrote: post #84

Isn't the whole solution to the problem: 1) Choose a good master password for you password manager 2) Remember it 3) !!! Don't write it down anywhere !!!

It’s not a solution if most people can’t or won’t do it.

The solution to murder is “don’t kill anybody,” but that’s not helpful in a discussion about preventing crime

Re: Double Blind Passwords a.k.a. Horcruxing

#88

Post by _wldu »

I wrote a program to generate passwords based on user input about 10 years ago. I still use it today and a few teams I have worked with still use it. I called it DPG. Deterministic Password Generator. It is a similar concept. I have implemented it in Go, C++, Java and Python.

I wish the idea of generating passwords when needed rather than storing and retrieving them was more popular. Traditional password Managers are just flawed.

https://github.com/62726164/dpg

Re: Double Blind Passwords a.k.a. Horcruxing

#89

Post by wyattpeak »

l1am0 wrote: post #84

Isn't the whole solution to the problem: 1) Choose a good master password for you password manager 2) Remember it 3) !!! Don't write it down anywhere !!!

I think there are a couple of problems in practice with this:

1) I don't leave my password manager open overnight, but I do during the day. My master password is long and I enter a lot of passwords. The most obvious attack vector is getting onto my computer while I'm working, not cracking the master password.

2) Losing my master password would be a _big fucking problem_. Once I'm confident I've learned it I destroy whatever it's on, but I can't risk having no backup before then.

Both of these points could be addressed if I were safeguarding nuclear launch codes. But I think it's silly to treat my passwords as national secrets. I'm not willing to abandon all convenience for the sake of safety.

Re: Double Blind Passwords a.k.a. Horcruxing

#90

Post by jakubp »

This doesn't address the key issue of how many "in head" horcruxes you want to have. Is it one and the same for all passwords? Then two broken passwords reveals it (if someone's clever maybe even 1, not sure here). If it's different for different passwords, you now need to memorize (or store elsewhere) a list of many, many such horcruxes. Not 7... but maybe a 100 or 200 to be practical for a heavy user of internet apps. Which basically means you need 2 password managers.

So where do I store the 100 horcruxes? What's your take on this?

Post reply on HN