Re: [Cfrg] Passwords - rethinked

[Otto Ersek <[e-mail]>]

Dear Yoav,

1. That's correct, it takes definitely longer, my wife was using "1982" 
as password now at least she has to "hide" it in the textfile (I changed 
1982 as well :-) )

2. The idea was to combine it with a password manager (unlock it using 
the secure pass)

3. And one should be able to submit the source text to the other end. 
Meaning send your source text to the admin to use it for your 
authentication procedure.

My sister (studying psychology) will conduct some research on this. 4 
different text files (a) famous quotes, b) short story, c) random data,  
d) foreign language text) to see if there will be collisions.

Your points are all valid,.. the idea was to provide means to 
additionally strengthen "weak" password by providing "more" ways for 
"input".
(Your example is great using a) changing capitalization and b) appending 
123, but even this weak modification is a hell of a brute forcing job)

No way remembering 15 different texts and the modifications that's 
clear, but I remembering 15 base95 passwords is not possible either,...

Thanx a lot for your feedback, I really appreciate it!
with kind regards

Otto


On 11/07/2016 01:43 PM, Yoav Nir wrote:
> Hi, Otto
>
> Just imagining using this, I can see two downsides:
>
> 1. I can type my password is under a second. Editing this text field 
> will take me a while (30 seconds?  Probably can get it down a bit)
>
> 2. If each website, SSH server and FTP server that I connect to 
> presents me with a different text (depending on the administrator’s 
> preference for Tolkien, Conan-Doyle or Roddenberry) it becomes harder 
> to remember how I edited each one.  So I end up with something like 
> flipping the capitalization of the first word, and adding “123” before 
> the last word:
>
> ####################################################################
> nEXT morning, after breakfast, we found Inspector MacDonald and White
> Mason seated in close consultation in the small parlour of the local
> police sergeant. On the table in front of them were piled a number of
> letters and telegrams, which they were carefully sorting and
> docketing. Three had been placed on one side.
>
> "Still on the track of the elusive bicyclist?" Holmes asked
> cheerfully. "What is the latest news of the 123ruffian?"
> ####################################################################
>
> How original am I?  Probably as original as all those people with 
> password “Passwd123” and slightly less than the l33t haxxors who 
> choose “pa55wd123”.  I’m guessing there will be a (relatively) small 
> number of transformations everyone will use and so the dictionary 
> attack does not go away.
>
> All this is idle speculation, though.  This requires an experiment 
> with real people (preferably not all of them college-age) to test that:
>  1. They’re willing to use this even without promising the $100 every 
> time they succeed.
>  2. They can perform the task within a reasonable time.
>  3. They can perform the task even when they have 20 different sites 
> with 15 different texts.
>  4. They can perform the task after not having used the site for a week.
>  5. There is enough entropy in the transformations that they come up with.
>
> A lot of authentication methods fail on usability. I suspect this one 
> might.
>
> Yoav
>
>> On 1 Nov 2016, at 7:58, Otto Ersek <[e-mail] 
>> <mailto:[e-mail]>> wrote:
>>
>> For 50 years we were using passwords and have built up paradigms to 
>> end up with something like this: JW=?mt%3D5z!.*zNpC as a standard 
>> password.
>>
>> First of all the good news, we don't need a long "password" to 
>> authenticate 4 base64 characters will do the job.
>> But this is not secure enough, to use the standard way.
>> Therefore let us completely change the way we submit a password.
>> And most importantly let us do the whole procedure in a human way
>>
>> The idea/concept is as follows:
>>
>> INSTEAD of a blinking login prompt sitting there and waiting 
>> desperately for a user password -> JW=?mt%3D5z!.*zNpC
>> let us present the user a simple text edit field with a short story 
>> in it, which can be any text, no need to keep that secret, everybody 
>> might even use the same!
>>
>> For example:
>> Kindly borrowed from the project Gutenberg.
>> Arthur Conan Doyle, THE COMPLETE SHERLOCK HOLMES, The valley of fear, 
>> The Solution
>>
>> Original text as it could appear to the user:
>> ####################################################################
>> Next morning, after breakfast, we found Inspector MacDonald and White
>> Mason seated in close consultation in the small parlour of the local
>> police sergeant. On the table in front of them were piled a number of
>> letters and telegrams, which they were carefully sorting and
>> docketing. Three had been placed on one side.
>>
>> "Still on the track of the elusive bicyclist?" Holmes asked
>> cheerfully. "What is the latest news of the ruffian?"
>> ####################################################################
>>
>> But how can a 100 years old text help authenticating today?
>>
>> What if we change the above text “slightly” to the following (sorry 
>> Dr. Watson!):
>> ####################################################################
>> Next morning, after breakfast, we found Inspector McDonald and White
>> Mason seated in close consultation in the small parlour of the local
>> police sergeant. On the stable in front of them were piled a number of
>> letters and emails, which they were carefully sorting and
>> docketing. Three had been placed on one side.
>>
>> "Still on the track of the eXClusive bicyclist?" Holmes asked
>> cheerfully. "What is the latest news of the ruffian?"
>> ####################################################################
>>
>> Sha512 of the "original version" is
>> 686027BE2595FF6BB7B7E0737D40B552753424D30D7B06CFA617165C022E256D
>>
>> Sha512 of the "modified version" is
>> C958DA6B2BC84AD4DEEE453E8654C94502A5F66E9B4E353937F9663A1A22CF04
>>
>> Well and that's it! Use the hash as an auth string,...
>>
>> PROPOSAL:
>> To achieve an estimated 36bits of security per round choose an 
>> arbitrary starting text of at least 1024 characters.
>> Copy some selected text and paste it somewhere into the text PLUS 
>> type before or after pasting some character from A-Z,a-z,0-9 (Yeah!!! 
>> No special characters needed! But if you really insist on using them 
>> go ahead)
>> Repeat 3 times. So in total 36bits x 4rounds = 144bits
>>
>> As long as we keep the changes made to the original text secure and 
>> follow the given proposal we should get a security level > 128bits, 
>> which is considered "secure" by today's standards.
>>
>> Summary:
>> 1) We still need some "password" but 4 characters should be 
>> sufficient. Further we need to remember the copy & paste sections. In 
>> total 4 + 4*3 = 16items to remember, but we have the original text in 
>> front of us as a visual guidance while doing our changes.
>> 2) The way we provide passwords has changed, not a blank field but a 
>> story is presented to us for us to make deliberate and memorable 
>> typos in it
>> 3) This should be easier to remember than the following 
>> funny-random-senseless ................... 24 character and 22 
>> character long strings:
>>
>> JWmt3DEz4VYEwQOhRKzyiWmA
>> ZF7IwsBlxGwwnvMLjpSMy9f3
>>
>> or slightly "shorter":
>>
>> }cM3MdgP'=\els6toBvTo[
>> u]o{^`>Mimn o_wlS}'.Ie
>>
>> For optional top notch security one may pick: arthur conan doyle, 
>> append shakespeare twice, append lord of the rings, append 
>> whatever,... but don't infringe copyright, only use books/texts you 
>> own! Then ask the user to authenticate in that file, and ask for more 
>> than 4 rounds,... but this is most likely overkill :-)
>>
>> _______________________________________________
>> Cfrg mailing list
>> [e-mail] <mailto:[e-mail]>
>> https://www.irtf.org/mailman/listinfo/cfrg
>