Timeline for How secure is this hash-based personal password scheme?
Current License: CC BY-SA 4.0
13 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 7, 2020 at 13:14 | comment | added | Silly Freak | @JonBentley but a password manager's master password can not be brute forced from information that might become available in a site breach. | |
| Apr 30, 2020 at 9:35 | comment | added | Jon Bentley | Regarding the second point - if the attacker knows your password is "my_p4SSWord!" then he also knows how to access your password manager. Yes, there could be some additional barriers to accessing the password manager, but in this answer you're making it sound like a stark difference between OP's solution and a password manager. Ultimately both solutions (in different ways) reduce multiple passwords down to a single access-all password. | |
| Apr 29, 2020 at 14:19 | comment | added | Tim Pohlmann | @DonHolgo I guess that's correct. I'm not versed enough in security to determine if that's an issue or not. But I assume that's not enough to make it secure. | |
| Apr 29, 2020 at 14:18 | comment | added | Tim Pohlmann | @Elling If you manage all your passwords like this, we are talking about a lot of services. One of them not having brute force prevention is enough. The more common (afaik) attack vector however is a leaked db: The attacker gets access to the actual hash value and can now run the brute force attack locally on his own computer. | |
| Apr 29, 2020 at 13:53 | comment | added | DonHolgo | @TimPohlmann If the login succeeds, I only know I guessed a password that for this site produced the same initial 12 characters of the hash as the correct one, don't I? | |
| Apr 29, 2020 at 13:49 | comment | added | bjaastad_e | @TimPohlmann Thank you, then I understand. But, for online services, how relevant is this as an attack vector? I assume that few vendors will allow you to hammer their services with repeated login attempts like this. And even if they do, I'm assuming it will be too slow. | |
| Apr 29, 2020 at 12:36 | comment | added | Tim Pohlmann | @Elling it's not about breaking the hash. It's about brute forcing your password: I guess a password, hash it with the known algorithm and send it to the corresponding service. If I log in, I know I guessed the correct password and can then produce the hashes for all of your services. | |
| Apr 29, 2020 at 8:24 | comment | added | bjaastad_e | @Esa Ok, I'll have to read up on Kerckhoffs's, I understand. But, just briefly, if the hashes were unbreakable (it would take millions of years to brute force), would the principle then be satisfied? | |
| Apr 29, 2020 at 8:08 | comment | added | Esa Jokinen |
Even with the edit (or rather because of it), this won't survive Kerckhoffs's principle: if your text file and the procedure was public, it would reduce your password to the original my_p4SSWord!, and once that's brute-forced against a single hash, all your passwords are known.
|
|
| Apr 29, 2020 at 7:31 | comment | added | bjaastad_e | I think it does survive Kerkhoffs's principle. See edit2 to my question. | |
| Apr 29, 2020 at 5:44 | comment | added | Esa Jokinen |
@Feek: Depends on the password manager and the type of local compromise. Some password managers have extra measures against other processes trying to access their memory. Also one way to leak information in this particular scheme is someone peeking over your shoulder: that's prevented in password managers by having ******* visible in the field where you could copy the password from.
|
|
| Apr 29, 2020 at 5:05 | comment | added | Feek | > But if you have a compromise on the client-side, this does no good This point is mute -- that argument can be applied to any sort of password manager | |
| Apr 28, 2020 at 16:45 | history | answered | schroeder♦ | CC BY-SA 4.0 |