Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just sat down at my work computer and began to unlock it by typing in my password, I got 6 of the 8 characters in and decided I wanted coffee and walked away to get it. I came back, realized I left most of the password in, typed in the remaining two characters and logged in. Out of pure curiosity, is there a security risk in that?

My thoughts are in most cases it wouldn't be problematic because it gives an attacker one attempt before it is reset and they must start from scratch. However, I suppose at a minimum it lets the attacker know your password is at least that number of characters long (assuming you typed it right) giving them an advantage for future attacks. Is there perhaps a way to grab the text that is typed into the login box, or maybe save the state so you can keep retrying from that partially completed point? What if this were a web page login as opposed to a desktop app?

share|improve this question
14  
Wow. I had the same though today! But I rather logged in and left the coffee for later. – Jakuje Jan 28 at 17:39
    
An 8 character password is already not very secure and if someone managed to steal your password hash, it wouldn't take long to brute force it. – Johnny Jan 30 at 7:57
    
@Johnny 8 completely random printable ASCII characters are 51 bits of entropy. That's pretty safe. – leftaroundabout Jan 31 at 11:26
up vote 43 down vote accepted

Corporate espionage is a thing.

There could be a security risk if someone has seen you typing your password, or guesses the last two characters. It's not all that difficult to notice people's keystrokes and subconsciously remember them, especially the last few keys.

In the case of corporate espionage, someone might want to watch you type your password, and they might remember it.

or maybe save the state so you can keep retrying from that partially completed point?

You have to admit, given the circumstances, this seems like next-level tinfoil hattery. I can just picture a guy in a grey suit walking up to your desktop, looking for your 20+ GB virtual machine disk, plus accompanying configuration data within a couple minutes, and taking it to a seedy cubicle in the corner of the office, then madly brute-forcing while cackling maniacally:

Dr. Evil laughing while brute-forcing OP

Let's take off the foil for a second. If you are running a virtual machine, then it's quite possible. You could save the state of the virtual machine at that point, and keep trying. The likelihood of this happening to you during a coffee break is pretty much zero. Same with the app state, only not as unlikely as a virtual machine.

With the virtual machine, a colleague would have to copy the contents of your virtual hard-drive, plus the accompanying settings, and mount it. More than likely, this would be in excess of 20 GB. Copying this virtual drive in such a short time while other people are around seems quite unlikely.

Someone will notice something.


What if this were a web page login as opposed to a desktop app?

Let's put on our tinfoil hats and see what we can do to retrieve the partially-typed password using only readily-available tools. Put yourself in the shoes of the attacker: how would you quickly get the password before the coffee break is over?

  1. Using the developer console, you can modify the web page to change this:

    <input type="password" name="pass" id="password"/>
    

    To this:

    <input type="text" name="pass" id="password"/>
    

    (Removed jQuery as suggested by Doyle Lewis)

  2. We can also get the values through the console input: you can use a variation of these (F12 > Console > Enter input):

    • console.log($("#password").val()); (jQuery)
    • console.log(this.pass.val);
    • console.log(document.getElementById("password").value); (dom)
  3. Apparently Windows 8 and Windows 10 Enterprise have an "eye" icon that allows you to reveal the plain-text password when holding down the eye button. This becomes an even bigger threat when someone else can just click that one button, bypassing all of the effort used in the examples above.


But why would this be a potential security risk?

Re-equipping our [Tinfoil Hat (Mythic Warforged)], let's assume a worst-case scenario:

With your username and password, in an enterprise setting where it definitely isn't difficult to find your username (usually your badge ID, or email username), a malicious colleague can attempt to impersonate you on the network. For example:

  1. Your corporation has WiFi access which requires your employee badge number and password to sign in.
  2. Malicious colleague logs onto the corporate network using your credentials, on an unauthorized device, and then wreaks havoc / steals things without it leading back to them. Most security policies should require device registration first, but there are unfortunately ways around that.
  3. You get blamed. It looks like you did it. And the spy who screwed things up may get away scott free.

How do I protect against this?

This very unlikely, but possible attack, and many other attacks that require physical access to your machine (not including hardware-based infections), is completely mitigated by locking your workstation before getting up, and not entering partial passwords. Make this your habit, and you won't have to worry about anyone doing something like this.

Don't get complacent, though.

share|improve this answer
4  
+1 for good and accurate tinfoil-hattery, but I feel its worth mentioning that the chances of such an attack happening during an unscheduled coffee break are unlikely. – David Grinberg Jan 28 at 15:26
6  
@DavidGrinberg why is that? I'm certainly able to produce the line console.log(document.getElementsById("password").value); under 30 seconds. Just how long are your coffee breaks if you think it's unlikely? – Dmitry Grigoryev Jan 28 at 15:33
9  
Really, you're making things too difficult with dev tools. Just double-click on "password" in the input type and change it to "text" and you've got it. That's the fastest/easiest way – Doyle Lewis Jan 28 at 15:44
9  
Additional note on unlocking a desktop: next to the password field (on Windows systems) there's an "eye" which can be pressed to show the password in clear text. This way, a huge part of your password can be revealed. Even if an attacker doesn't know the password length, the length of your password has been shortened considerably. And as most passwords are 8 characters in length (due to minimum pw length requirement being set a 8 chars), there's a huge chance the attacker only has to bruteforce 2 more characters. – GroundZero Jan 28 at 16:05
4  
@GroundZero as Mark said in this particular case I'm using Enterprise so there is no eye, but that is a valid point for other scenarios – DasBeasto Jan 28 at 16:56

In addition to the other answers, while you were away I installed a keylogger on your keyboard.

In the short term, I have the last 2 characters of your password. I could use that to reduce the search space considerably for a brute force attack.

But I am lazy and a long term thinker. I am just going to wait until you log in again and I will have your complete password.

share|improve this answer
7  
Wouldn't this be a problem at all times though not just if I left a partial password in, I think "never get up for coffee" is the only preventative measure for this. – DasBeasto Jan 28 at 16:28
1  
@DasBeasto just carry your computer with you at all times – emory Jan 28 at 16:31
2  
+1. This is a valid, and quick attack. Using easy-to-remember url shorteners to link to executables, and then running them, is quite possible. @DasBeasto Lock your workstation. – Mark Buffalo Jan 28 at 16:40
4  
@DasBeasto But you also asked about web login forms. A web login form being visible assumes your device is unlocked. – Mark Buffalo Jan 28 at 16:46
3  
@DasBeasto I always treat my employer's information with utmost care and with Tinfoil Hattery. Security breaches start when people become incompetent and/or complacent. Many companies have a lot of secrets they'd like to protect. Trade secrets, techniques, etc. The problem is, attackers usually go after those with little technical knowledge, as those users have access to corporate email accounts, can send out emails, and some may have access to sensitive things. Example. Information security is everyone's business. – Mark Buffalo Jan 28 at 16:52

As noted in the comments, some version of Windows have an "eye" symbol that can be clicked to show what you've typed into the password box.

If you leave six of your characters in the lock screen password box, it takes only one click on the eye to expose the plaintext. This does not mean the attacker would know how long your password is, but does mean it would weaken your password's security because the first six characters are exposed.

I can confirm, Windows 10 Enterprise does indeed have this eye.

share|improve this answer
    
@Schroeder Noted. I was planning on expanding this with a screenshot, but I think I'll have to setup a VM to get one. Tried on my own machine's lock screen, but no screenshot's taken. Probably a good thing since it would then copy the plaintext into the clipboard. – Booga Roo Jan 29 at 0:03
    
Looks good after the edit – schroeder Jan 29 at 0:08
    
Good to know about Windows 10 Enterprise. This is more of a reason not to type partial passwords into your login forms. – Mark Buffalo Jan 29 at 0:33

Applications will internally store the password bits you've already typed. Some of them might do so in ways that allow an attacker to retrieve them. For instance, we discussed in a previous question how passwords typed into Internet Explorer could be printed into the IE console by a user.

Besides that, there's the risk of having someone guess the missing characters (as pointed out by @MarkBuffalo) since many passwords tend to end with special symbols or numbers (very specifically, many passwords end with "1"). If you've been observed before, or an attacker has prior knowledge of a password of yours, they could succeed in completing your partially typed password.

share|improve this answer
    
wow! if the attacker can get a partial password, and there was a maximum password length of 8 and a small set of required characters and the attacker noticed none of the required characters were in the partial password, then the brute force space is not large at all. – emory Jan 28 at 16:38
    
@SteveDL Kind of an edge case, but you can write a program to read all of the available memory in use by a specific program, and then search for the user's entered password string that will be stored in memory. You'd have to know the password in advance, or very slowly find it through trial and error. – Mark Buffalo Jan 28 at 16:45
1  
@MarkBuffalo indeed, though if you can do that you're on an unconfined system, might as well implement a keylogger :-) – Steve DL Jan 28 at 17:00
    
@SteveDL Agreed, I just like coming up with oddball/different ways to do things. :P – Mark Buffalo Jan 28 at 17:01

Potentially, yes. Even more so if people have watched you type it previously, and hence seen where you fingers leave the keyboard from.

For a web form, you basically have to assume that anyone who can modify the web page can see your password - either by changing the password field to a text type, by monitoring what characters are pressed (JS keylogger, in effect), or, for older browsers, by simply looking at the properties of the password field in the in-built inspector (most modern browsers seem to restrict viewing of content typed into password fields, as a security thing, although they will still reveal whatever is sent in the value attribute, since anyone looking at the page source can see that.

It also confirms your username - you're unlikely to bother typing in most of your password in the wrong username screen for a shared computer. Depending on your setup, this could be sensitive info.

share|improve this answer

This almost certainly depends what you were logging in to. For instance, if it was a web form it would be easy to write some Javascript in the developer console in order to get the current value of the password field without raising suspicion.

Compare this to if you were typing it into your Windows login screen where there is no easily accessible console to type in commands in order to extract the value. Worst case scenario if no one saw you type the first part of your password is that someone either sees you type the last two characters independently (probably less likely to be fluidly typed and easier to discern) or tries the password knowing that there are only two characters left (length is the easiest quality of a password to get) as a guess and if they fail there is also little risk to them.

share|improve this answer

Technically you have put you and your fellow employees and employers at risk for an attack. The 6 digits of the alone are already enough for some to get a general idea of the format used (if the company requires a password format). Also a corporate spy could view the 6 of 8 and just set up a bruteforce attack to only crack the last 2. However in the case a potential attack does not know the password length it will take longer to crack since they are so many combinations.

share|improve this answer
    
You seem to be assuming that an attacker will be able to access the six characters that the OP already typed.  Why do you assume that? – Scott Jan 28 at 22:52
    
I am assuming that the password box is plain text and not redacted. However, depending on where the OP was typing the information (i.e. a web browser) an attacker could just modify the web page using inspect element to remove the redaction and view the password box in plain text. – CorruptedOffset Jun 15 at 17:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.