HashMask - Another (More Secure) Experiment in Password Masking
1–10 of 32 posts
Re: HashMask - Another (More Secure) Experiment in Password Masking
#2I was beginning to get perturbed by the inundation of password fields lately, but I actually really like this one. However, I think that it would be more effective as a browser plug-in than a site feature.
Re: HashMask - Another (More Secure) Experiment in Password Masking
#3I was beginning to get perturbed by the inundation of password fields lately, but I actually really like this one. However, I think that it would be more effective as a browser plug-in than a site feature.
I agree. Different implementations will undoubtably use a different visualization technique making it hard to recognize at all the different sites. Though in theory this is a non issue because everyone uses a different password per site, right?
Re: HashMask - Another (More Secure) Experiment in Password Masking
#4No, this is retarded; the "unique nonreversable visualization" is trivially attacked offline by brute forcing with a dictionary of passwords. It's just the SHA1 of your password; fundamentally no different from tacking /etc/shadow to your password field as you type.
It wouldn't be retarded if it wasn't expending a lot of effort (and confusing the hell out of users) to get to that bad destination. But that's what it does.
When you consider "solutions" to this "problem", model it against an adversary with a camera.
The author of this post means well, but just masking the password characters, like every secure system has done for the past couple decades, remains the right answer.
Re: HashMask - Another (More Secure) Experiment in Password Masking
#5No, this is retarded; the "unique nonreversable visualization" is trivially attacked offline by brute forcing with a dictionary of passwords. It's just the SHA1 of your password; fundamentally no different from tacking /etc/shadow to your password field as you type. It wouldn't be retarded if it wasn't expending a lot of effort (and confusing the hell out of users) to get to that bad destination. But that's what it d…
How often do you type your password next to an adversary with a camera?
Re: HashMask - Another (More Secure) Experiment in Password Masking
#6No, this is retarded; the "unique nonreversable visualization" is trivially attacked offline by brute forcing with a dictionary of passwords. It's just the SHA1 of your password; fundamentally no different from tacking /etc/shadow to your password field as you type. It wouldn't be retarded if it wasn't expending a lot of effort (and confusing the hell out of users) to get to that bad destination. But that's what it d…
How often do you type your password next to an adversary with a camera?
I did it about 50 times today. I'm a building full of cameras. Tell me, how often do you sweep the surrounding area for cameras before you log in somewhere? Thought so. How many times have you ever logged into something from an airport? Ever hear about the Microsoft Blue Hat talks about the pen testers who collect credentials at Sea-Tac?
People just like memes. They're fun to talk about. I promise you there are 1,000 better problems for you to tackle in your app than the suboptimality of password masking. This guy managed not only to waste time, but also to promote an actively evil security extension.
Re: HashMask - Another (More Secure) Experiment in Password Masking
#7No, this is retarded; the "unique nonreversable visualization" is trivially attacked offline by brute forcing with a dictionary of passwords. It's just the SHA1 of your password; fundamentally no different from tacking /etc/shadow to your password field as you type. It wouldn't be retarded if it wasn't expending a lot of effort (and confusing the hell out of users) to get to that bad destination. But that's what it d…
How often do you type your password next to an adversary with a camera?
The goal regardless is to not provide a visual clue to an eavesdropper which they could use discover your password.
I actually don't think the idea of this is all that terrible, just that the implementation isn't right. For example, I can't think of a reason why the representation needs to be unique -- the user would only need a clue if their password is the wrong length or if they likely have a typo. Also, the specific representation used is too resource-intensive; three colored boxes would work just as well.
Still, even if the system returned hundreds of possible passwords for a given hash, and even if it wasn't resource-intensive, it's still providing clues to a third party, which you don't generally want to do. You're still dramatically decreasing their search space.
EDIT: On second thought, there might be a way to make this a little less horrible. If you assume that the user will generally be very close to correct in typing their password, then you could tune a function that would produce dramatically different results for similar passwords, and similar results for dramatically different passwords -- a kind of inverted hash function. Such a function probably already exists, I'm just not familiar with it. If you did that, and completely obscured what the user was typing, so that an eavesdropper couldn't tell the length of the password, then you might be increasing the search space compared to simply displaying asterisks.
Re: HashMask - Another (More Secure) Experiment in Password Masking
#8Earlier quoted context omitted.
How often do you type your password next to an adversary with a camera?
I did it about 50 times today. I'm a building full of cameras. Tell me, how often do you sweep the surrounding area for cameras before you log in somewhere? Thought so. How many times have you ever logged into something from an airport? Ever hear about the Microsoft Blue Hat talks about the pen testers who collect credentials at Sea-Tac? People just like memes. They're fun to talk about. I promise you there are 1,000…
Why are you worried about how people with cameras could eventually brute force your password from that tiny, fuzzy smear of colour on the screen, when those same cameras can see your fingers typing the whole damn thing in, in plaintext?
Re: HashMask - Another (More Secure) Experiment in Password Masking
#9I was beginning to get perturbed by the inundation of password fields lately, but I actually really like this one. However, I think that it would be more effective as a browser plug-in than a site feature.
I agree. Different implementations will undoubtably use a different visualization technique making it hard to recognize at all the different sites. Though in theory this is a non issue because everyone uses a different password per site, right?
Right, at a glance you could see if someone used the same password in more than one place. Of course, you could circumvent the whole issue by pairing the url with the password to generate the hash.
Re: HashMask - Another (More Secure) Experiment in Password Masking
#10This is neat, I like it better than the last one. I would try to come up with a more lossy version. Maybe something that hashes to one of 50 animal icons. The algorithm should be good enough that any one-letter-off typo never results in the same icon. More secure, and easier to remember.