- One of the sites is compromised
- One of your devices is stolen/lost and you have to change some passwords
- One of the sites has a password expiration policy
Pretty soon you end up with multiple password schemes and you're in precisely the same situation as before, wondering which password goes with which site, only this time you have to perform algorithmic dances in addition to memory feats.
• Passwords that prevent double characters within the password: not ideal when using a scheme.
• Passwords with a minimum/maximum length: I've seen sites with a minimum of six characters and other sites with a maximum of eight characters. That means, to cover them all, you really have to choose a password of exactly six, seven or eight characters and even then it's no guarantee.
• Sites that prevent certain punctuation and other sites that require punctuation. That means you have to remember which sites require which.
• Likewise, sites that require/prohibit capital letters or require a mix of case.
It's a nightmare doing anything other than recording them somewhere. And recording them somewhere is not great either as you always have to carry that thing with you and, if it's electronic, remember to charge it.
The concept of illegal characters is tied for second. If you're handling it right, there should be no such thing - yet so many sites continue to set arbitrary limitations for reasons that aren't clear even to them.
Kind of wish I could just generate private keys for each site and not think about it anymore. (Yes, I know there are some convoluted ways to do this, but they're not particularly usable.)
THe best part is that even so many new and/or modern sites enforce the same arbitrary requirements.
This one really grinds my gears because it also indicates that they're most likely storing your password in the clear. Hashes are all the same length.
There are 3 'tricks':
1. First, use several different initial functions for different levels of security, each with different levels of complexity (i.e. f1(user,domain), f2(user,domain), etc).
2. Then, use a function for password requirement rules (i.e. g(f(user,domain),rules)).
3. Finally, use a final function for rotating passwords (i.e. h(g(f(user,domain),rules),rotation)).
So, all together, maybe 5 different algorithms, each of different levels of complexity.
You'd think that this would be very difficult to manage, but it hasn't been in practice. Very, very few times do I pick the wrong initial algorithm when trying to derive my password. And, in that case, I can quickly iterate to the correct password within 3-4 tries.
Most of the time I get it on the first try. Sometimes, I get it on the 2nd-3rd try. Very, very rarely (< 1%), I cannot derive it within 5 tries. And, at that point, I just do a password reset (and rotate the password using the h function).
There's no solution for passwords today, better than the password manager.
People reading this article, should not consider Manuel Blum's idea as use-worthy.
I can trust a password manager, but I would keep an offline physical backup, and they're not the 'ultimate solution'
Write your password on a piece of paper and store it safely (what constitutes 'safely' may vary. For most people, an envelope in the bottom of a drawer is plenty safe.). Put the actual password database on Dropbox and make sure it's replicated in a couple of locations.
> they're not the 'ultimate solution'
Nobody said that, so your quote-marks are out of place. The GP said that there is no better solution today.
> and they're not the 'ultimate solution'
Negative statements have less information than positive ones.
I don't need a backup, because my password manager syncs with my phone and tablet. Loosing those two and my computer simultaneously would put me in really big trouble, but statistically I'm much more secure than transmitting non-truly-random passwords across the Internet.
It's stored on four of my devices. It's stored on Dropbox as well, but a compromise of Dropbox won't give the attacker anything because it uses secure crypto and I have a strong master password.
EDIT: This seems like much more effort than just using a password manager, or even just a stronger, memorable passphrase or two.
You have to be specific when you pick the algorithm if it's to work the way the author suggests, and preferably something that is not easily shifted, such as the domain name and not the site's title.
#!/bin/sh
#usage: webpass.sh <website>
website=$1
stty -echo
read -p "Password: " password
echo
stty echo
echo -n "$website" | openssl sha1 -hmac "$password" | cut -d" " -f2 | xxd -r -p | base64 | tr -d -c "[:alnum:]"
echo
For me, this happens less often than once a year. And then it is a good idea to change all passwords anyway.
The alternative is to store passwords somewhere in a password manager. However if this storage gets somehow lost/compromised ALL of your passwords get lost/compromised.
To deal with changed passwords and password restrictions, I use a page with of mapping for each issue to an updated base url or changes to be applied to the forged password.
It replaced all my alternatives and I don't have to think anymore about passwords. It saved me a lot overseas and doing a new fresh install in my computers is not painful anymore.
For example,...
1. User clicks login 2. Webcam uses facial recognition to identify the user. 3. The identified user is requested to enter their password.
In this case, I think, it is harder to impersonate the real user. I am no expert but would interested to know if anyone can see any obvious flaws or if something similar exists?
Also, shouldn't there be standard encryption schemes for doing stuff in your head? That homemade matrix encryption is probably not very hard to break.
So "Superdonkey11_amazon" and "Superdonkey11_dropbox" would be strong passwords, where compromising one to a password database leak would only jeopardize other passwords if a human would pick out your password and think about how it applies to other services you use.
If you have to change your password with the site just cycle through a couple root passphrases. You now have salted your password per site in a human-memorizable way without some weird algo ritual to access every password.
It's easy to write a script that looks for "dropbox," "Dr0pbox," etc and replaces them with "twitter" and "Tw1tter" respectively.
I think the industry should come up with a better solution for managing passwords.
Here is a snip from the first email:
Begin ---%<------------%<---------------------------------
As I understand it, the algorithm, expressed in Python is:
#########################
import sys
from string import ascii_uppercase as alphabet
# ABCDEFGHIJKLMNOPQRSTUVWXYZ
LETTER = "31415926535897932384626433"
NUMBER = [0,2,4,6,8,1,3,5,7,9]
def f(ch):
assert ch in (alphabet + "0123456789")
if ch in alphabet:
return int(LETTER[alphabet.index(ch)])
if ch in "0123456789":
return int(ch)
def g(n):
return NUMBER[(NUMBER.index(n) + 1) % 10]
def pw(s):
digit = g((f(s[0]) + f(s[-1])) % 10)
result = [digit]
for c in s[1:]:
digit = g((digit + f(c)) % 10)
result.append(digit)
return result
print(sys.argv[1], pw(sys.argv[1]))
#########################
pw(“ABC”) == 928
pw(“ABCABC”) == 928362
It’s actually worse than this. For example, if the adversary knows that:
pw(“AAT”) == 941
pw(“ABC”) == 928
pw(“BBC”) == 717
f(“C”) == f(“T”)
pw(“BBT”) == 717
pw(“B.*T”) == 7.*
pw(“BAT”) == 728
pw(“BAT”) == 728
pw(“XAB”) == 725
pw(“XAAB”) == 7271
pw(“XAAAB”) == 72725
My second email on Sept 30, 2014 contained the solution to a challenge he proposed in the video of a lecture on the method he gave:
Begin ---%<------------%<---------------------------------
On one slide during your recent lecture, you present a bit of a challenge, and I noticed that by making use of just the four plaintext/ciphertext pairs:
BRAIN -> 06076
TRAIN -> 27732
GRAIN -> 35618
DRAIN -> 54349
6159073428
8106279354 <- this turns out to be the one
AND -> 496
g(0) -> 6
g(1) -> 0
g(2) -> 7
g(3) -> 5
g(4) -> 8
g(5) -> 0
g(6) -> 2
g(7) -> 9
g(8) -> 1
g(9) -> 3
f(A) -> 5
f(B) -> 8
f(D) -> 0
f(G) -> 6
f(I) -> 2
f(N) -> 3
f(R) -> 0
f(T) -> 0
The details of this decryption aren't very interesting, so I won’t go into detail. I didn't need to use a computer, just paper and pencil. The important observation was that from BRAIN -> 06076 one knows
g(0 + f(R)) -> 6
and from TRAIN -> 27732 one knows
g(2 + f(R)) -> 7
thus if g(k) -> 6, g(k+2) -> 7.
This means that map(g, [0,1,2,3,4,5,6,7,8,9]) is some rotation of the list [_,_,_,_6,_,7,_,_,_,_] where 6 and 7 are at two locations apart.
Every letter, say 'A', which appears in more than two places in any of the plaintext/ciphertext pairs reveals information about g(). So BRAIN -> 06076 and TRAIN -> 27732 also reveals that
g(6 + f(A)) -> 0 and g(7 + f(A)) -> 7
Therefore, if g(k) -> 0 then g(k+1) -> 7. Thus, we can now conclude that map(g, [0,...,9]) is some rotation of [_,_,_,_,6,0,7,_,_,_].
In this fashion I concluded that map(g,[0,...,9]) was some rotation of [2,9,1,3,6,0,7,5,8,4]. I knew that g()'s corresponding permutation was a circular permutation with a single cycle because that was a part of the system that makes it easier to memorize.
In general, of course, there could be ten possible mappings, one for each rotation. However, in practice some of these rotations won't produce a permutation with a single cycle. This isn't really a problem because ten possible mappings for g() are still easy to validate in the next phase where we derive the mapping f(). In this particular case, there were only two possible circular permutations making it easy to decrypt the system with just paper and pencil.
The next step is to try out each of the possible g()'s determined above on the plaintext/ciphertext pairs. For example, BRAIN -> 06076 implies that
g(0 + f(R)) = 6
applying the inverse map of g() to both sides
0 + f(R) = 0
so
f(R) -> 0
In this manner the entire decryption can be performed.
End ---%<------------%<---------------------------------
http://files.catwell.info/misc/mirror/mickens-usenix/thiswor...
"“But James,” you protest, “there are many best practices for choosing passwords!” Yes, I am aware of the “use a vivid image” technique, and if I lived in a sensory deprivation tank and I had never used the Internet, I could easily remember a password phrase like “Gigantic Martian Insect Party.” Unfortunately, I have used the Internet, and this means that I have seen, heard, and occasionally paid money for every thing that could ever be imagined. I have seen a video called “Gigantic Martian Insect Party,” and I have seen another video called “Gigantic Martian Insect Party 2: Don’t Tell Mom,” and I hated both videos, but this did not stop me from directing the sequel “Gigantic Martian Insect Party Into Darkness.” Thus, it is extremely difficult for me to generate a memorable image that can distinguish itself from the seething ocean of absurdities that I store as a result of consuming 31 hours of media in each 24-hour period."
Article with bad advice (not controversial - just plain bad), agreed by every single person in this conversation; yet in the front page of hacker news.
Beats me every time.
[/ Off-topic - Meta rant]
Friend of mine actually built one off SHA1 and it's all open at https://github.com/simontabor/pw/ or www.pwapp.io. It's 40 chars so much much better than pwdhash (but that's the original I guess).
Check it out and tell me what you think!
https://nicosandller.firebaseapp.com/projects/passwordshelpe...