2

I have come up with the following approach to remember master passwords (to use in software like KeePass, etc): Since it is annoying to type the master password every time we power up the PC, we store a text file that contains an unanswered, personal question. The master password is obtained by answering the question, saving the text file and calculating the SHA256 check sum. Then we edit the file again to delete the answer, and save the file again.

My question is, are there some obvious flaws on this approach (rather than social ones: say we are 100% certain that we are the only ones that know the answer)?

Improve this question
5
  • 2
    Why do you have to save it in a file and then delete it from the file? Why not just calculate it?
    – user253751
    May 5, 2022 at 17:18
  • Is this really any more secure than just having a bunch of random seeming text files and only you knowing that the checksum of one of those files (and which one) is your master password? Or even just having a text file that has a list of system files with their associated checksums, and only you knowing that the 42nd on the list is your master password? It seems like extra steps for no benefit.
    – Michael Richardson
    May 5, 2022 at 19:31
  • 7
    How is typing a phrase into a text file easier than typing it into a dialog? Much less having to remember to delete it later.
    – HiddenWindshield
    May 6, 2022 at 1:45
  • 3
    Seems like you have a problem at this step: "saving the text file" If I understand what you're saying, the clear-text password is saved to a file and then it's check-summed. If that's what you were intending, then you have a pretty significant vulnerability just in the file contents alone.
    – mikem
    May 6, 2022 at 3:55
  • 1
    Relevant XKCD. It's really not that hard to remember 4-6 (or more) randomly generated words.
    – FreeMan
    May 6, 2022 at 17:41

3 Answers 3

Reset to default
18

In your scheme, the SHA-256 hash is just sugar, anyone with knowledge of your system (and you should assume an attacker has this knowledge) can recreate it, hence its security is limited by how difficult it is for an attacker to guess the answer.

And if that answer is a honest one, you can easily be worse off than using it as the master password directly, because the question gives the attacker a hint, and might make it very easy to hack.

Improve this answer
1
  • 2
    Indeed, the answer becomes the master password. Applying a single round of SHA-256 to it is just an ineffective key stretching on top of the effective key stretching your password manager already does.
    – Fax
    May 6, 2022 at 17:21
6

You are probably looking for using a keyfile, e.g., stored on a USB stick.

Other options are devices like the Yubikey, that can store a password (some can protect it using a fingerprint reader) or PGP-Keycards that decrypt your passphrase on the device itself in a way that the master key never leaves the device.

Improve this answer
1

Unfortunately the answer is yes, keeping in the spirit of your methodology (which from a "pure" security standpoint is terrible, but a good starting point that's better than a sticky note under the keyboard; it's good that you're asking the question!). This method is fine to keep random people out of your password list, but a determined attacker will go through this easily. (See brute-force attacks for an idea how)

Since you're saving the file with the password (possibly the correct password) and then re-writing the file, there is a good chance that the file is not actually being overwritten on disk (and a simple spelling error could leave a copy around too). This means that a search of the file system by an attacker could find the bytes that were stored by your file.

If you didn't write the file with the password and just calculated your checksum with the password in memory, it makes this process slightly more secure (nothing on disk ever has any password attempt), but as mentioned by other answers, it's still based on the question being answered being a closely guarded secret.

As mentioned by others, some sort of USB keyfob for each person would potentially be a better option. This would also allow you to just remove someone's lost keyfob from the allowed set of fobs if they misplaced it.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .