The Best Way To Protect Real Passwords: Create Fake Ones 152
jfruh writes: Many security-savvy users have a password manager that stores their randomly-generated passwords — but if that manager is cracked, the gig is up. Some security researchers are suggesting a technique to stop this: a password manager that offers up fake passwords when an attacker tries and fails to crack it, which makes the process of figuring out if you've broken in much more difficult.
Difficult? (Score:4, Interesting)
Re:Difficult? (Score:5, Funny)
No, this will solve the problem once and for all.
Re:Difficult? (Score:5, Insightful)
Why should a password manager like this know if it's generating a valid or invalid password. Surely all it needs to do is generate a salted hash based on the website name, a random value it generated when you installed the software and your entered password that protects the vault. Any salt entered will generate a result, but only the salt you are expected to remember will generate valid passwords.
You should get the advantage of strong lengthy random passwords for the websites you use, and some added value in that if your password file is compromised it remains challenging to brute force since each generated password needs to be tested. The disadvantage is that some sites may not place limits on the number of login attempts making brute forcing possible and then the overall security comes down to the strength of the salt you chose.
Re: (Score:2)
If I was using this password system, wouldn't having the file give the person who obtained the file a list websites/systems that I have access to, along with my user name? I'm not sure if that's such a great trade-off. Currently I have a password safe (keepass) that keeps the entire password database encrypted until you enter the correct password. The password I have is quite long, and would probably take a huge amount of computing resources to brute force.
Re: (Score:2)
It's a tradeoff. Encrypt the URLs and make it easy to tell when the manager password has been found without having to try the managed passwords, or leave the URLs expose and make it hard to tell when the password has been found. *shrug*
Simple solution (Score:2)
All the password manager needs to do is take the name of the account want a password for, tack on the ow manager password, hash it. That's what it returns as the account password
There done. No need to check if you entered the right password for the manage. No need to even have a password management database. Or pay for anything since it's a one line perlscript. Since the ow manager has no clue if you entered their right password or not it won't give it away. One can think of embellishments to allow yo
Re: (Score:3, Funny)
Oh, the fools! If only they'd built it with 2 layers of password spoofing! When will they learn!?!?
Re: (Score:2)
Yo nerd! I heard you like passwords on your passwords.
Re:Difficult? (Score:5, Interesting)
This just adds an extra step to automate: take the password and try to login. It's not like people are manually trying passwords...
That actually makes things a lot more difficult. Many systems have password lockout, meaning that you would lose access before cracking the manager. Also even if one does not have lockout the delay of an internet call will slow down the attempt rate significantly
Re:Difficult? (Score:5, Funny)
Let's see them crack THAT!
Re:Difficult? (Score:5, Funny)
+1 Funny (Score:2)
Re:Difficult? (Score:5, Funny)
Me too. But I've instructed my secretary to generate a fake set of post-it notes if someone comes into the office pretending to be me.
Re:Difficult? (Score:5, Funny)
I have fake passwords on a post-it note stuck to my monitor.
My REAL passwords are on a post-it note stuck to the bottom of my keyboard.
You fools with your single layer of misdirection, thinking it will keep you safe!
Re: (Score:2)
My passwords are on a post-it note stuck to my monitor. Let's see them crack THAT!
Reflection off your glasses picked up by your monitor's camera. :-)
Re: (Score:1)
My passwords are on a post-it note stuck to my monitor. Let's see them crack THAT!
Hey, what's written on that Post-It note stuck to your monitor? Just curious.
Re: (Score:2)
My passwords are on a post-it note stuck to my monitor. Let's see them crack THAT!
Hey, what's written on that Post-It note stuck to your monitor? Just curious.
system: slashdot.org
password: ************
Re:Difficult? (Score:4, Interesting)
Its a damn good way to get busted as well. IDS sensors and SEIM systems will pick up on a small number of hosts performing a large number of authentication attempts or a large number of hosts making attempts against the same account.
Either way you going to at least tip off the site operator. If your target is a free webmail host or something there might not be much they could/would do but a corporate security team will probably alert the account owner, and watch that account very carefully, will other folks contact the lawyers and the authorities to hunt your ass down.
Re: (Score:2)
Have unlimited fake ones then. Any keys will unlock your vault, only the right key will reveal the correct passwords. Good luck trying to login with unlimited attempts.
Re: (Score:2)
I use SSH keys everywhere. (Score:2, Funny)
I've always heard that SSH keys are better than passwords. So I use them even with websites that don't use SSH.
Here's what I do:
1) I generate a new keypair using ssh-keygen.
2) I put the public key in my GitHub repo, because the public key is meant to be shared.
3) I use the private key as the password when I sign up for a new account on a web site. I copy and paste it into the password input since it's too big for me to type in.
4) When I have to log in to the web site I copy and paste the private key into th
Re: (Score:2)
Or you could use a single private key to cryptographically sign your username concatenated with the site's host name, resulting in a site-specific, secure password. No need to store hundreds of passwords, just the usernames (which could be duplicated) and a single private key.
I'm sure there are password managers out there that do this.
(Disclaimer: IANACryptographer --- there may be something braindead about this scheme)
Re: (Score:2)
Truncates password to 8 chars (Score:2)
I don't get it either but it's not "stupid" per say since it will get you (if you use the standard 2048-bits size) a password with a length of 372 that is infeasible to crack.
Except when a site truncates the password to 8 characters.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
I'm guessing the joke is that he only ever logs in once since he doesn't save the private key anywhere?
In any case, needs a "not particularly funny" mod.
Re:Difficult? (Score:4, Informative)
Testing password against local file: about 1 microsecond.
Testing password by trying to login to Facebook, Slashdot, Yahoo, etc: about 1 second.
So if anything it's going to cut down your password test rates from a million a second to one a second. That's already a great hurdle for password crackers. This even before any rate-limiting by those websites kicks in.
Automated attack (Score:2)
Re: (Score:2)
Because this system would show the attacker an account and password for every manager password entered.
With a normal password manager, the attacker is told if they're right or wrong. With something like this, when it tries Password! on the manager, it gets results, just they're wrong and it has to try to use one to find out. Then it tries Password1 on the manager, gets results, has to test, etc. So it has to add a verification step and not just attack the password manager. Of course, you're likely to lo
Re: (Score:1)
If only the passwords (& not usernames or URLs or whatnot) are encrypted & no checksum or other verification is used, then entering the wrong master password could very well cause it to decrypt to completely useless but structurally valid passwords.
Of course, care would need to be taken to ensure the result is always valid...probably have a "password format" field that indicates what format the password is allowed to have (at least 1 of each of these types of character, at least 8 characters & n
Re: (Score:2)
The digital version of having a couple of post-its (Score:1)
I have a pile of post-its. One contains the passwords. The other contain also all kinds of notes, as well as old passwords and shopping lists. Main difference with the proposed method in TFA is that hackers may still have access to the digital fake passwords, but will never get my post-its.
Obviously, these can get stolen too. But only a trusted select few people have physical access to this, and even they don't know which post-it to take. And no hacker is going to physically break into my place to look for
Re: (Score:1)
Don't be too sure. I recently had a 5x8" notebook (the physical paper kind) stolen while I was at a customer site (accessible to the public). They didn't take my wallet, tablet, phones or tools, but the notebook and pencil vanished. It even had my name & phone number in the cover, but, nothing.
While it didn't contain any passwords (ok, it contained one IP address/router admin password but I changed it as soon as I got back), it did contain notes from that night that I would have liked to have for wrappi
They're missing the opportunity... (Score:5, Funny)
Recurse (Score:5, Funny)
We need a password managers manager!
... It's password managers all the way down.
Re: (Score:2)
Re: (Score:2)
How can none of these responses start off with, "Yo dawg, I herd you like password managers, so..."?
Re: (Score:2)
How can none of these responses start off with, "Yo dawg, I herd you like password managers, so..."?
The usual reason. You weren't looking hard enough [slashdot.org].
Surrealist password manager: (Score:2)
Re: (Score:2)
Ceci n'est pas un password.
Ceci est une sword?
Over think (Score:4, Informative)
Honestly this should be pretty simple. The default operating mode of a password manager should be generate a password from PRNG data.
Store the value encrypted with AES a key derived from a master password extended via PBKDF-2 or similar should be used for the cipher.
Next apply the necessary mixture bitwise rules applied bytewise to the 'clear text' to ensure the password will contain type-able characters and accommodate character restrictions. (Something like x = ((x % 126); x = x | 32 if x 32; for those of us using ascii and yes its not perfect and will produce some bias maybe a crypto expert could propose a better alternative ) Store which rules must be applied as well. That should not be an information leak as the attacker probably can research the target system and divine these requirements anyway.
That will mean most of your passwords are nearly random goblody gook. (Important). No matter what master password is used a key can be derived, the decipher operations and the rules can be applied the result will appear to be a legal password, but it will be incorrect. In the event you have stored a specific less random value it should 'decipher' as well but appear highly random given that is how all your other password appear to be it will not be a strong indicator the wrong key has been chosen either.
Re:Over think (Score:5, Informative)
The NoCrack authors mention this briefly in their paper (PDF) [jbonneau.com]. They call the approach you describe "stateless password managers", and briefly describe some of the drawbacks of the approach:
Chiasson et al. conducted a usability study of both PwdHash and Password Multiplier and found the majority of users could not successfully use them as intended to generate strong passwords. Another usability challenge is dealing with sites with a password policy banning the output of the password hash.
But yeah, I'm not convinced the problems they highlight are intractable, nor that NoCrack solves them.
Re: (Score:2)
NoCrack seems extremely vulnerable to a crack since they create decoys on the fly. It should be fairly trivial to pick it apart and tell when you're getting a real password from the vault. As for the stateless password managers, they operate without any kind of wallet which is their problem. Also you can't change password for any reason, that's a problem too. If you have a wallet most the problems go away. I'm thinking as follows:
The wallet stores a PRNG value to avoid various rainbow attacks. For each site
Re: (Score:2)
I do the same thing with sha256.
echo -n "myseed+username+website" | sha256 | cut -c1-20
echo -n "myseed+0100010001010011+slashdot.org" | sha256 | cut -c1-20
I'm thinking about writing a base65 encode function for websites that require !@#$%^&*().
Re: (Score:2)
I'd guess the difficulty is that you want everything encrypted: that is, the password database will contain a list of website or server names, as well as the usernames and also the passwords. It's pretty difficult to distinguish between a valid and invalid password assuming they're generated randomly according to sets of rules. However, the rest of the data is likely to be human readable and full of standard dictionary words.
So it's only easy to make the password database inscrutable upon attempted decryp
So how does this work? (Score:3)
As the maker of a password manager, I'm curious how this is supposed to work. The article is a bit sparse on information.
Suppose I'm the attacker and after say, ten guesses the fake passwords are shown. So if I now save the passwords, will the original ones be overwritten? I guess not, since that would be rather inconvenient. So if not, will the fake passwords along with the master password and the original data be stored in the password database? Than the attacker can check the length of the original file after saving to determine whether he has obtained fake passwords. Or are they assuming some mysterious online password application where the user has no knowledge of where and how his passwords are stored? In that case, the application will be insecure anyway.
I suppose the right way to make this work is by saving fake passwords (or the space for them) along with the real ones all the time but encrypt them separately with the fake master password after it has been created on the fly. Thinking about it, I might add this as an option to my program.
Re: (Score:1)
If an attacker has your password file you should not be worried about saving the original passwords. Either your machine is stolen or your password database has been copied.
Re:So how does this work? (Score:5, Insightful)
Possibly - but then the best way is just to let any password open the vault.
You cannot crack a password DB if every attempt to open it succeeds. If your means of validating the password you used is to read a stored password, close the vault, reopen it and re-read the password to ensure its still the same.. then you've just added one heap of time to your cracking attack.
Of course, a password vault could return the same set of fake passwords if you failed to supply the correct key (ie when you store a new password, the system generates a fake to store alongside it and returns the correct, or fake one depending on correct unlocking)
No need to re-gen when the vault has been opened incorrectly, just return the bad passwords and let the attacker try to use them. What's even worse than having to re-open your vault to check the passwords are the same, is having to take one of those passwords and use it to attempt login to a 3rd party site to validate whether they were the correct passwords or not!!
If you really want to be a bitch to attackers, you'll expose a few valid entries to honeypots (with passwords that work) so the attacker may think he's got the correct unlock :-)
Re: (Score:2)
Possibly - but then the best way is just to let any password open the vault.
This is highly undesirable. Even knowing which services I find worthy enough to include in my vault is important. If the attacker knows my gmail, linkedin, or more niche account username, and doesn't see it in the vault, then they will get suspicious.
Re:So how does this work? (Score:4, Interesting)
What you're proposing sounds like Kamouflage (PDF link from TFA) [bojinov.org], with only 1 decoy password set (Kamouflage suggest 10,000); and suffers from the problem of generating plausible fake master passwords without revealing anything about the real master password, as mentioned by the authors of NoCrack.
What the NoCrack authors try to achieve is a solution where every incorrect guess at the master password still provides a set of (incorrect but at least sometimes plausible) passwords. A bit like a one-time pad, which is the only provably secure encryption, because brute-forcing the key yields all the possible plain texts (both the correct and all the incorrect ones). Of course, the problem with the one-time pad is that the key length matches the plain text length, which would completely eliminate the benefit of a password manager. Additionally, as noted in TFA, authorized users might not like the idea that making a typo when entering the master password yields (seemingly) correct passwords. :-)
I'm not convinced the NoCrack authors have actually succeeded, as they claim, but can nevertheless recommend the NoCrack paper (PDF) [jbonneau.com], since it discusses pros of cons of the approach and alternatives.
Re: (Score:2)
Count me amongst the skeptics.
What the NoCrack authors try to achieve is a solution where every incorrect guess at the master password still provides a set of (incorrect but at least sometimes plausible) passwords.
That's a bad design. If the attacker can access the password file, then he will usually also be able to save your fake passwords from within the password manager. Think about your wife trying to find out the password for your porn collection. So either she may (perhaps inadvertently) delete the original ones, which would be a disaster, or you need to have padding space in the original file so the attacker cannot detect that you have saved the additional files. And you cannot ha
Seen something similar before (Score:5, Interesting)
P.S: company eventually got sold to a bigger player and the home grown license manager was retired for industry standard "FlexLm". Soon after, ALL software using Flex were cracked and sold on the warez sites. Pirates could have easily cracked the license manager of that small company, but it is too small to be worth the effort.
Moral of the story: Monoculture is bad, both for Irish potato farmers of the 18th century and license/password managers of the 21st century.
Re: (Score:2)
Actually what will happens is that some users will use a cracked version as some sort of trial and then buy the real version if they are satisfied with the program. This is what I have sometimes done when the software doesn't have any trial versions available to test. But if you have quiet crashes, corruption or weirdness in your program the users will think that your program is just really crappy, stop using it and never buy it.
Re: (Score:2)
Re:Seen something similar before (Score:5, Insightful)
The buyers will get some unreliable software, possibly reducing the "trust" on the warez hacker and sowing discord among the pirates and their customers.
Ah, naivete. Any time I feel like humans are smart, I just come here and read, and I'm cured. Guess what? The unreliable software was being used as a trial by potential future customers, who just decided it was a massive pile of shit and used a competitor's software. If they ever actually made money with the software, then they bought it. Their competitors thank them for their sophomoric DRM scheme which guaranteed that everyone thought their software was shit.
Moral of the story: DRM is stupid, an people who think tricky DRM which shits on potential future customers is cool are also stupid.
Re: (Score:3)
Re: (Score:2)
So you got the full, unlocked version? Not that it matters, because everything I said stands. Lots of people don't want to mess with all of that noise.
Re: (Score:2)
I agree with you DRM for music/video does not work, and most people would pay for hassle free legal access and those who pirate would never bu
Re: (Score:2)
The only ones pirating these software are those who would/could never pay for legitimate licenses.
No, you missed the point. If this software is so valuable, why? If it is for support, the "pirates" are not receiving support. If it is for the money-making potential of the software, if the unpaying users actually make money with it, they become far more likely to pay for it, not less. This is precisely what I was talking about to begin with. Adobe is shooting themselves in the foot by making Creative Suite subscription-based, because it just drives people to alternatives when it's harder to copy Adobe sof
Re: (Score:2)
Ah, naivete. Any time I feel like humans are smart, I just come here and read, and I'm cured.
Just skimming through your post, I see that you've incorrectly assumed the following:
1) That those illegal downloads represented lost sales. Haven't the RIAA and MPAA taught you anything about the faultiness of that logic?
2) That the people torrenting the software were potential customers to begin with. When it comes to B2B software, which is what is being discussed here, there are established channels for procuring demos or trials of software. You don't torrent it unless you never had any plans to be a cus
Re: (Score:2)
That those illegal downloads represented lost sales.
Too bad you can't read. That's not what I said at all.
When it comes to B2B software, which is what is being discussed here, there are established channels for procuring demos or trials of software.
Some people don't want to dick with your established channels, because they don't trust your salesdroids and don't want to talk to them. If you follow established channels, you usually get sales spam for the rest of your life.
That a competitor even existed.
Show otherwise, and I'll show you're wrong.
If the recent examples of pirated games being crippled are anything to go by, people are finding them "hilarious", rather than being upset.
They aren't, because we're talking about business software. You must have serious ADHD because you can't stay on topic for more than a couple of seconds.
That pirates of B2B software complain about the quality of the software.
They don't complain. They use someth
Re: (Score:1)
Ah, naivete. Any time I feel like humans are smart, I just come here and read, and I'm cured.
Some humans did go to the Moon. I cling to that when I feel myself sinking in the Slough of Despond.
Re: (Score:2)
Re: (Score:3)
More likely, I would think this would reduce the trust of the software and original software developer. After all, the software appears to be working, other than the "bugs". Most users aren't sophisticated enough to think "maybe that shady warez site did something that affected the original software!", they'll just think the original software is crap
Re: (Score:3)
The weak point (Score:2)
"There is, however, one large problem: What if a person mistypes a password? In that scenario, a fake vault is generated, and a user is locked out of his or her accounts."
This is the weak point - It forces the user, or the system, to generate an additional artifact to inform the user (but hopefully not the attacker) that the password safe is correctly unlocked.
"One possible fix is to create a hash of the master password that is linked to an image that is shown when the password is entered. The authorized user should recognize when the wrong image is displayed, but an attacker would not."
I'd expect this one image to be shown only when the master password is entered. i.e. it is an unique indicator. Fake images will need to be generated for all other passwords, and if there are duplicates then they can be eliminated as false-positives. Strategies like this will always be the weak point. It's commenda
Paranoia (Score:2)
Am I the only one who thought to himself "Do I actually have anything to hide that would justify this much effort?"
If somebody hacks my ebanking account, chances are the bank would be liable unless they could prove I have been negligent. And besides, this whole security thing becomes rather funny when you think that my bank is the only site which limits my password length to seven digits.
This is like a company that puts up draconian password restrictions, does not trust just hypervisors but also switches, c
Re:Paranoia (Score:4, Insightful)
Re: (Score:1)
Re: (Score:1)
duress password (Score:1)
this would be improved if the password manager provided a password that when used, an alert was issued and actions were taken
Pointless (Score:1)
This security mechanism is pointless. The only way that this would work is through obscurity. If you know the algorithm to check the data file itself in the same way the password manager does, you just offline attack the actual database. Once you reverse engineer the password vault software's behavior, you can go straight to the file instead of being a dumbass and typing things into the program itself.
I can't think of a single attacker (other than maybe a teen's mom) that would repeatedly type passwords
Re: (Score:2)
Re: (Score:2)
We take a significantly different approach. Instead of explicitly storing decoy vaults, we construct single ciphertext which, when decrypted with any wrong master password, yields a decoy vault that appears to have been sampled from the distribution of plaintext vaults (across the entire user population). This approach is inspired by the theory of honey encryption [23].
Still not certain I understand how that works, but it certainly isn't an obvious or trivial approach to take.
Locked out (Score:2)
The problem with giving out a fake password would be that the real user ends up locked out of sites or systems due to too many bad password attempts.
Unnecessary (Score:1)
Re: (Score:3)
When I was a child:
My parents used to know the phone numbers of every family member off by heart.
When I was a teenager:
I could recite pi to hundreds of decimals places after creating a program that ran on an Amstrad PCW9256 to calculate it (I had to check the answer!), and I still can just from memory. I memorised an entire Shakespeare sonnet just because I needed to for a drama production. I still know it - word-for-word - to this day.
Since then:
I memorise and use dozens of passwords every year. I have
Re: (Score:1)
Re: (Score:2)
I do not trust any software with my password. Sorry. Certainly not EVERY password I have - some of my passwords literally only exist as a hashed and salted version, and in my brain.
Nor would I trust a basic user downloading something that claims to hold all their passwords, or to know to only put their "master" password into that app, or to not forget their master password, or to install it on all the devices they have so that losing their phone / laptop doesn't lose all their passwords etc. It's a silly
Re: (Score:2)
Re: Unnecessary (Score:1)
Deception (Score:4, Interesting)
Deception is a valid form of security, similar to obfuscation. It should not be relied upon, but it is merely another layer. In the early 90s me and some buddies ran a multi-node BBS. One of the admins used the same password on another BBS, and someone was able to log into our system using his admin account. So to prevent that from ever happening again, I wrote a script that, for the three site admins, would also ask for their birthdate every time they logged in. If an incorrect date was entered a single time, the account would be locked. Thing is, it wasn't our birthdates that we had to enter, but just another very short password that we could enter really easily. So an attacker, if they got to that point again (obtained the password), would give it their best guess (or perhaps even research to find) the admin's birthdate. If any date was entered at all (containing two slashes or hyphens) the account was immediately locked, because the expected password was just a couple letters is all, and anyone entering an actual date was not an admin.
Re: (Score:2)
Re: (Score:2)
So the car is like a fake car that drives you to the wrong building? Or does it do its best to kill you somehow?
Re: (Score:1)
Re: (Score:2)
Right. These "security questions" web sites have you set up now, like "mother's maiden name", and such? I use some completely unrelated information. That way, if someone does the research, or an ex-lover wants in, they won't be able to use that information.
But having your password manager compromised is a rare situation. If everyone used them, and used them properly, we would have no need of these two-step authentication schemes.
This makes no sense (Score:1)
I assume this solution would be based around the app providing bogus passwords if you enter a bad master password. I suppose that would be something you could do for foiling the petty pickpocket or keystone cop. But surely any attacker that actually plans to succeed will use a cryptographic attack against the data store, not poke random keys on the UI.
I have wondered before if security could be improved by storing an encrypted file inside another encrypted file, ideally with different schemes. But from
Tamper Reactive (Score:2)
Obligatory XKCD link (Score:2)
Re: (Score:2)
Of course, the wrench technique only works if the attackers have physical access to your body. Most Internet hackers aren't going to be located physically near you (and hopefully most of them wouldn't have the stomach for that either).
Might help if they're not all fake (Score:2)
Slightly connected.... (Score:2)
This reminds me of a question I had about securing a linux server.
We all know it's quite good practice to move the SSH connection from port 22 to some arbitrary high port. But of course if attacker finds nothing on port 22 he's just going to start port scanning until he gets it.
Way better would be for port 22 to respond as a valid SSH server but to reject ALL username and password combinations EVEN THE CORRECT ONES.
Only drawback I can see is when I forget I moved the SSH port and get confused when my passw
Re: (Score:2)
its key OR TFA.
if you log in with a ssh-key, PAM is skipped and your TFW-scheme is not invoced.
It takes offline brute-force to online brute-force (Score:2)
now: crack the master password with five million guesses per second on your cluster
then: search the ten services with weakest security (as many guesses as you want), start to brute-force the generated passwords for random master-passwords until ones works with 10 services, which allow one (confirmed correct/incorrect) login in two seconds. And may inform you of the cracking attempt.
Re: (Score:1)
Re: (Score:3)
If someone has access to your password management software, and the ability to test out passwords on it and get "the other" passwords back (real or not), then it's a fraction of a portion of a miniscule slice of a second to test whether that password actually DOES anything.
At worst, it'll make it slightly easier to trigger password attempts logins. But at best, something is still brute-forcing your password-management that holds every password you have.
Camouflage works in real life. It doesn't work agains
Re: (Score:2)