Are partial passwords a security improvement over full passwords?

Question

With full password authentication, you need to enter the full password every time.

With partial password authentication, you're asked for some subset of the password each time, and which characters you need is different for each attempt.

This paper says some things about partial passwords.

The main security benefit supposedly is that it guards against people who see you enter the password. With full passwords, once it's been seen once, they can login whenever they want. With partial passwords, seeing it once doesn't get them in unless, the exact same characters are requested again.

Just for the sake of discussion, I'll call the one who sees you the "observer" and the event where they see you enter a correct partial password once an "observation".

Observer doesn't need to be a person. Key-loggers can do the job too.

The paper looks at an attack where an attacker gets one chance to login and can only know characters that have been observed, and how the probability of success is related to the number of observations. Actually that probability increases very fast, which suggests partial passwords aren't adding all that much security.

But of course real attackers are a lot smarter than that. They may only need one observation for a brute force attack to be viable. There's various different ways of making passwords, like Diceware, but generally the characters are related, because that makes them easy for us to remember. It also means that knowing one character helps figure out the others. At the very least an attacker can apply a dictionary to cut down the password search space by a lot. That's also assuming they need the full password, which they don't, they only need some few characters when they try to login, and some of those they may already know.

With full passwords, one observation brings the guessing entropy down to 0. With partial passwords, it wouldn't destroy all the guessing entropy, but I think the drop would be large enough to push most passwords into brute forcing range, so not much improvement there over full passwords.

Attackers can also guess the characters in an authentication challenge. Those few characters have a lot less guessing entropy than the full password, so there is a weak point there. If they get it right, they will be authenticated once. It also reveals some characters like an observation, and those known characters can be used in other attacks.

As for database compromises and offline cracking, partial passwords are a little worse. Once an attacker has one observation, either created from brute forcing or actually observed, they can figure out the rest of the characters. They can have one guessed character and the rest known characters, and try the values for the guessed character until they get it. The whole password is revealed in linear time. At least, that's what would happen with a simple implementation using Shamir's secret sharing and some hashing, perhaps other methods can mitigate these problems.

Some banks are already using this, so it seems partial passwords are more secure in some way, or maybe it's just security theater. I'm skeptical that partial passwords offer much security improvement, but I haven't done much statistics to see how much protection it could offer. Have I missed something here? Are partial passwords any significantly more secure than full passwords? Or perhaps less secure?

---

I intended originally to compare the guessing attacks to the Hangman game, but it's different enough that I'd be giving the wrong idea, so I cut that out. Still interesting to think about it that way though, Hangman with passwords.

Answer 1

Threat Modeling

Here is the question you need to answer first: "What is the most common way passwords are stolen?". Sometimes security measures can't help but present trade offs in one way or another, so a more "secure" method is only "better" if it protects you against the most likely threats. So let's consider where passwords are most in danger.

Despite not having a reference, I think it is safe to say that the answer is a resounding Hackers gaining access to poorly secured passwords in web applications. As evidence I merely point out the fact that some of the largest dumps of leaked passwords from websites number in the hundreds of millions and even billions of passwords. It just seems impossible for "shoulder surfing" (whether via keyloggers or actual shoulder surfing) to be as important as a threat to the average person's security than poorly secured passwords in a database.

The big picture

Here's my point: even if asking for partial passwords granted users substantial protection against shoulder surfing, and even if you did it in a way such that brute forcing the login endpoint (which is effectively what you are thinking about when you discuss decreased entropy), it would still be extremely dangerous because it will require violating the most important rule of password security. Namely, I think it would be just about impossible to pull this off unless you stored passwords in plain text or (barely better) with reversible encryption. You could probably come up with a way to do it by using "strong" hashing on all possible combinations of partial-passwords for every user, but I imagine that such a system would be quite a pain to manage from a code/database storage perspective. As a result, you would have to weigh whether or not the increased security (which is not clearly better) is worth the additional hassle of a more complicated login system and the increased chance of bugs that naturally comes from doing things "fancier".

My Answer

As a result, I would say that they are almost certainly substantially less secure, as I would guess that most implementations are storing passwords in plain-text on the server side. This makes the passwords much more vulnerable in the event of a data breach, which is a substantially more likely threat to your average web user. Securing the user from an obscure threat vector while making them more vulnerable to the threat that is most common is a big loss. I don't know whether or not the benefits claimed in the article are accurate or not, but I think they are missing the big picture, and therefore the question is moot.

An aside

As a final note, sometimes it's easy to miss additional threats introduced by a new security measure simply because its new and hasn't been thoroughly tried yet. As an example, when people first started storing passwords online I doubt they realized the threat that database leaks in conjunction with password reuse would post, which is why so many systems (even today) store passwords in plain-text. This system is likely no different. I can point out one very obvious reason why (I think) this would actually make shoulder surfing more dangerous. I doubt the average user will be able to answer a query like "Give me letters 2, 3 and 6 from your password" (taken from the paper abstract) easily off the top of their head. I doubt I would. If I didn't give it much thought I would probably do what most people would probably do after scratching their head for a minute: write down their password on a piece of paper and circle the letters being requested. Now your password is even easier to read for any shoulder surfers, as well as the janitor. As a result, even without the large caveat above, I suspect that if this method seems better it is only because it hasn't been used enough for the main problems to be found.

A better answer

Occasionally questions show up here suggesting alternate password schemes. My answer in all cases are pretty much the same: the inherent problem with passwords is that people are bad at passwords (easy to guess passwords, password reuse, etc...). The solution isn't to do passwords "better". The solution is to not do passwords. As a result, if you were running a website and wanted a better way to protect your users, the best bet isn't to make your users beta-testers for some not-yet-well-vetted password scheme. Rather, the best bet is to try to ditch passwords all together. Browsers are just now starting to support password-less login methods (with webauthn looking like the coming standard). The technology is a bit young yet (i.e. there may yet be undiscovered implementation weaknesses) so I might wait a bit before using it on critical systems (banks, email, etc...). However, moving to a password-free login method will be a much better option..

Answer 2

I expect the answer is actually the opposite: partial passwords are less secure than full passwords.

Why? Because real-life users need things to be easy. To guarantee this, they will do all sorts of things that make security experts cringe, like writing down their passwords and using weak passwords. Partial passwords make things even more difficult, so users will write down their passwords more and use even weaker passwords – perhaps a short sequence of characters repeated many times – to make up for it.

The answer to all these problems is to use a password manager. But if a user is using a password manager correctly, then how could a partial password possibly be a security improvement over a full password? In fact, a partial password should be less secure than a full password, because it’s easier to guess.