1

With full password authentication, you need to enter the full password every time.

With partial password authentication, you're asked for some subset of the password each time, and which characters you need is different for each attempt.

This paper says some things about partial passwords.

The main security benefit supposedly is that it guards against people who see you enter the password. With full passwords, once it's been seen once, they can login whenever they want. With partial passwords, seeing it once doesn't get them in unless, the exact same characters are requested again.

Just for the sake of discussion, I'll call the one who sees you the "observer" and the event where they see you enter a correct partial password once an "observation".

Observer doesn't need to be a person. Key-loggers can do the job too.

The paper looks at an attack where an attacker gets one chance to login and can only know characters that have been observed, and how the probability of success is related to the number of observations. Actually that probability increases very fast, which suggests partial passwords aren't adding all that much security.

But of course real attackers are a lot smarter than that. They may only need one observation for a brute force attack to be viable. There's various different ways of making passwords, like Diceware, but generally the characters are related, because that makes them easy for us to remember. It also means that knowing one character helps figure out the others. At the very least an attacker can apply a dictionary to cut down the password search space by a lot. That's also assuming they need the full password, which they don't, they only need some few characters when they try to login, and some of those they may already know.

With full passwords, one observation brings the guessing entropy down to 0. With partial passwords, it wouldn't destroy all the guessing entropy, but I think the drop would be large enough to push most passwords into brute forcing range, so not much improvement there over full passwords.

Attackers can also guess the characters in an authentication challenge. Those few characters have a lot less guessing entropy than the full password, so there is a weak point there. If they get it right, they will be authenticated once. It also reveals some characters like an observation, and those known characters can be used in other attacks.

As for database compromises and offline cracking, partial passwords are a little worse. Once an attacker has one observation, either created from brute forcing or actually observed, they can figure out the rest of the characters. They can have one guessed character and the rest known characters, and try the values for the guessed character until they get it. The whole password is revealed in linear time. At least, that's what would happen with a simple implementation using Shamir's secret sharing and some hashing, perhaps other methods can mitigate these problems.

Some banks are already using this, so it seems partial passwords are more secure in some way, or maybe it's just security theater. I'm skeptical that partial passwords offer much security improvement, but I haven't done much statistics to see how much protection it could offer. Have I missed something here? Are partial passwords any significantly more secure than full passwords? Or perhaps less secure?


I intended originally to compare the guessing attacks to the Hangman game, but it's different enough that I'd be giving the wrong idea, so I cut that out. Still interesting to think about it that way though, Hangman with passwords.

  • 1
    Your points sound pretty good, not much to add in this direction. Just one thing: "Ideally" passwords are random, with no relation between their characters. ... Other than that, you're forgetting about the "casual" attacker. Some average person watching an acquaintance login won't continue with calculating entropies, getting cloud servers for bruteforcing, etc. The very same person could very well steal some money if the full password was known without additional work. – deviantfan Oct 1 '18 at 1:57
  • Good point there with the casual attacker. Partial passwords might be no better against determined attackers, but it might stop enough casual attackers to be an overall security improvement over full passwords. – EPICI Oct 1 '18 at 2:08
2

Threat Modeling

Here is the question you need to answer first: "What is the most common way passwords are stolen?". Sometimes security measures can't help but present trade offs in one way or another, so a more "secure" method is only "better" if it protects you against the most likely threats. So let's consider where passwords are most in danger.

Despite not having a reference, I think it is safe to say that the answer is a resounding Hackers gaining access to poorly secured passwords in web applications. As evidence I merely point out the fact that some of the largest dumps of leaked passwords from websites number in the hundreds of millions and even billions of passwords. It just seems impossible for "shoulder surfing" (whether via keyloggers or actual shoulder surfing) to be as important as a threat to the average person's security than poorly secured passwords in a database.

The big picture

Here's my point: even if asking for partial passwords granted users substantial protection against shoulder surfing, and even if you did it in a way such that brute forcing the login endpoint (which is effectively what you are thinking about when you discuss decreased entropy), it would still be extremely dangerous because it will require violating the most important rule of password security. Namely, I think it would be just about impossible to pull this off unless you stored passwords in plain text or (barely better) with reversible encryption. You could probably come up with a way to do it by using "strong" hashing on all possible combinations of partial-passwords for every user, but I imagine that such a system would be quite a pain to manage from a code/database storage perspective. As a result, you would have to weigh whether or not the increased security (which is not clearly better) is worth the additional hassle of a more complicated login system and the increased chance of bugs that naturally comes from doing things "fancier".

My Answer

As a result, I would say that they are almost certainly substantially less secure, as I would guess that most implementations are storing passwords in plain-text on the server side. This makes the passwords much more vulnerable in the event of a data breach, which is a substantially more likely threat to your average web user. Securing the user from an obscure threat vector while making them more vulnerable to the threat that is most common is a big loss. I don't know whether or not the benefits claimed in the article are accurate or not, but I think they are missing the big picture, and therefore the question is moot.

An aside

As a final note, sometimes it's easy to miss additional threats introduced by a new security measure simply because its new and hasn't been thoroughly tried yet. As an example, when people first started storing passwords online I doubt they realized the threat that database leaks in conjunction with password reuse would post, which is why so many systems (even today) store passwords in plain-text. This system is likely no different. I can point out one very obvious reason why (I think) this would actually make shoulder surfing more dangerous. I doubt the average user will be able to answer a query like "Give me letters 2, 3 and 6 from your password" (taken from the paper abstract) easily off the top of their head. I doubt I would. If I didn't give it much thought I would probably do what most people would probably do after scratching their head for a minute: write down their password on a piece of paper and circle the letters being requested. Now your password is even easier to read for any shoulder surfers, as well as the janitor. As a result, even without the large caveat above, I suspect that if this method seems better it is only because it hasn't been used enough for the main problems to be found.

A better answer

Occasionally questions show up here suggesting alternate password schemes. My answer in all cases are pretty much the same: the inherent problem with passwords is that people are bad at passwords (easy to guess passwords, password reuse, etc...). The solution isn't to do passwords "better". The solution is to not do passwords. As a result, if you were running a website and wanted a better way to protect your users, the best bet isn't to make your users beta-testers for some not-yet-well-vetted password scheme. Rather, the best bet is to try to ditch passwords all together. Browsers are just now starting to support password-less login methods (with webauthn looking like the coming standard). The technology is a bit young yet (i.e. there may yet be undiscovered implementation weaknesses) so I might wait a bit before using it on critical systems (banks, email, etc...). However, moving to a password-free login method will be a much better option..

  • The most rudimentary implementation I've seen is with Shamir's secret sharing. Looks like this: github.com/TBits/partialPasswordShamirsSecret It uses linear storage space and isn't reversible so that's good but it still doesn't defend against low guessing entropy problems. I get that very important sites can also have bad password management, but it can be implemented well and I wondered how it could compare then. Bad implementation is still an issue though I agree, and might be shadowed by other issues and threats anyway. – EPICI Oct 1 '18 at 4:22
  • @EPICI goodness gracious, whoever wrote that needs to figure out how to name variables. Making sense of that code is a bit of a pain... – Conor Mancone Oct 1 '18 at 12:07
  • @EPICI Having looked it over for a bit, I'm very dubious about your assertion that it is not reversible. Whoever wrote this is more or less just using a home-grown hashing algorithm, and it is very unlikely to be secure. The fact that they used a function to generate random numbers that is specifically not cryptographically secure is a bad sign - that's a bit of a rookie mistake and whoever did this is not actually very familiar with cryptography. If nothing else, this is very vulnerable to offline brute-force which can recover the full password. – Conor Mancone Oct 1 '18 at 12:18
  • As a result, using this particular implementation will make user passwords even more vulnerable in the event of a database leak, aka the most common way for passwords to get leaked. – Conor Mancone Oct 1 '18 at 12:19
  • 1
    @EPICI Interesting. First time I've read about Shamir's secret sharing. My suspicion is that for passwords it will be far too susceptible to brute forcing, but I'm not familiar enough to know for sure. Overall though it doesn't change the big picture: implementation is going to be difficult (although bad implementation can potentially be fixed), but I think there are plenty of downsides that will become more obvious if it became more common (I gave one example). However, I think it mainly fixes the wrong problem, and the best answer is ditching passwords, not changing how they work. – Conor Mancone Oct 1 '18 at 15:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.