Are each card produced with a different substitution pattern ?
A plastic card for easy to remember strong passwords
91–100 of 110 posts
Re: A plastic card for easy to remember strong passwords
#92How about doing Vigenere in your head? This is what I do: I actually write my passwords down in my little black book, which I carry in my pocket. I use a simple Vigenere cypher in case I lose the book. Each password is encrypted with the same master key, which I memorize. For example, if my master key was 1234, and my password was 'baNana3', it would write down 'ayKwmy0'. When I look up the password, I shift the lett…
If you physically protect your book sufficiently and don't let anyone who is a threat see it, and choose strong passwords (which baNana3 isn't for most purposes - it's only 7 characters long, and based on a dictionary word with minor modifications) then yes.
If someone willing to put in the effort to do some cryptanalysis obtains a copy of your book, then no, you are most likely not safe. Firstly, the Vigenere cipher is extremely vulnerable to a known plaintext attack on the key - if the person who obtained your book knows your password to just one site (for example, because it was lost in a compromise and published on the Internet), they can work out your master key and then get all your other passwords. Even if they don't know any passwords, if you use passwords that are not made up of equiprobably randomly selected characters (and especially if they are dictionary words), the attacker will usually be able to use that bias to work out the master key. For example, the attacker might cycle through all words in the dictionary to obtain the key that decrypts aykwmy to the word, and try the master key they obtain on other entries in your book until they find one that yields a lot of other dictionary words.
Re: A plastic card for easy to remember strong passwords
#93Earlier quoted context omitted.
Any authentication system will (and should) fail if you lose the authenticator. That's not "shitty", that's the way it's supposed to work. A better system, to be of any value, would fall prey to the same 'weakness'. Even biometrics can change over time.
Math/Crypto allows for distributed authentication. Think bitcoin block chain, miners verify each transaction and but it doesn't rely on any single miner.
The bitcoin blockchain relies on the assumption that the mining power is honest and no single entity will hold the majority of the mining power. This has proven to be an issue with the selfish miner case and when a single mining pool reached 51% of the total mining power.
In the world of security you simple cannot assume honesty and build security on top of this assumption.
Re: A plastic card for easy to remember strong passwords
#94I'll just leave this right here: http://xkcd.com/936/
Re: A plastic card for easy to remember strong passwords
#95Earlier quoted context omitted.
The site is only an example. You would actually order your own unique card to carry with you. No one would be able to guess your password since your spacebar code is unique to your card.
This is wishful thinking, factor in the actual organization doing global surveillance and spying, say NSA who is known to intercept hardware to flash firmware with backdoors and suddenly the need to guess is no more, your card can be legally copied at any point between production or transportation to you.
Oh my god, if you really worry about NSA hacking your accounts, then probably this card is not for you. And they probably don't need to guess your passwords, they can just get in with a court order. This is for people who are still using passwords like "password12345" because ".;l[ppop[o#@!" is too hard to remember.
Re: A plastic card for easy to remember strong passwords
#96This is a substitution cipher and it's not very secure. Consider what we can do if we compromise the Amazon password that's given as an example on the website: sh(/J3HqAfQsu..u.rqf Since the password came from Amazon, we know that the last 6 characters are "Amazon," which tells us that: . = A u = M r = Z q = O f = N Now we can start attacking the codeword, which are the characters between the 8-character "space bar c…
It's vulnerable to a known ciphertext attack, yes. But the assumption of password usage is that the password itself is never stored - the ciphertext of this cipher should itself not be available to an attacker. An attacker looking to bruteforce a compromised file of passwords is going to struggle to figure out that your password is sh(/J3HqAfQsu..u.rqf. Even if they do find it, what would tip them off that it was gen…
With such degree of character's reuse you must trust the attackers are not the admins of a site where you use those password, because they can look at the cleartext entered on the keyboard. Obviously this is still an improvement over using the same password123 for every single site but those nasty admins could easily check if a password ends with characters matching their domain. Then all the schema falls apart.
Re: A plastic card for easy to remember strong passwords
#97It's rather ironic this site is all about strong security, when their SSL/TLS settings are terrible. (Including being open to the POODLE and OpenSSL CCS vulnerabilities) https://www.ssllabs.com/ssltest/analyze.html?d=qwertycards.c...
Thank you for bringing this to our attention - we’ve now upgraded the server to address this and will continue to monitor carefully for any other issues.
Re: A plastic card for easy to remember strong passwords
#98Earlier quoted context omitted.
> This sort of objection is raised whenever basically any mechanism for remembering strong passwords is presented. Yes, because we've basically realized that memorizing passwords isn't a workable solution. We should be recommending password managers that generate/store strong passwords and MFA for any account that needs to be secure. That these password generators themselves can now be unlocked using both memorized i…
> Memorizing passwords isn't a workable solution Correct analysis, > recommend password managers No! Passwords should never be considered as secure material, period. Centralizing in a password manager centralizes the burden. There are half a dozen other workable solutions, among which authentication by email (What else is the reset-by-email link?), Mozilla Persona and all kinds of asymetric keys.
> Centralizing in a password manager centralizes the burden.
So does using a single email account for everything.
Re: A plastic card for easy to remember strong passwords
#99Except it's not going to work, because of the bank who doesn't allow '(' as a special character, or the ticket website that requires at least 3 digits, or the financial firm who only allows 8 character passwords. As soon as you have a few sites with 'rogue' password policies, the system breaks down.
I tried going to a similar algorithm of my own invention some years ago, and ran into this exact problem. Mostly sites that don't allow certain characters (which is asinine). Now I have a few different algorithms that I use that are friendly to common password requirements, and I keep a list of which algorithm I used on each website, rather than just a list of the passwords. Since the algorithms only exist in my head…
You are not alone in this strategy. I just wish we could have a password standard.
Re: A plastic card for easy to remember strong passwords
#100Earlier quoted context omitted.
Just use random words. Memorable passwords don’t have to be weak. Five random common english words are already very strong. Just make sure you don’t pick the words by hand.
Except this has stopped being strong a while ago, since it has been popularized by xkcd in 2011 cracker have incorporated this scheme in their password cracking routines. Bruce Schneier blogged about this last year: https://www.schneier.com/blog/archives/2014/03/choosing_secu...
Except Schneier is just plain wrong about this. The numbers presented in XKCD comic were already assuming that the attacker has full knowledge about how the passwords are generated, including the wordlist used. This has been discussed over and over in various places, including HN. Long story short, there is no shortcuts for attacker against true random bits of entropy.