Slashdot Mirror
Password Autocorrect Without Compromising Security (threatpost.com)
msm1267 quotes a report from Threatpost: Intuitively, auto-correcting passwords would seem to be a terrible idea, and the worst security-for-convenience tradeoff in technology history. But a team of academics from Cornell University, MIT and a Dropbox security engineer say that the degradation of security from the introduction of such an authentication mechanism is negligible. The team -- Rahul Chatterjee, Ari Juels and Thomas Ristenpart of Cornell University, Anish Athalye of MIT, and Devdatta Akhawe of Dropbox -- presented their findings in a paper called "pASSWORD tYPOS and How to Correct Them Securely" at the recent IEEE Symposium on Security and Privacy. The paper describes a framework for what the team calls typo-tolerant passwords that significantly enhances usability without compromising security. The paper focuses on three common types of password errors that users make while typing: engaging caps lock; inadvertently capitalizing the first letter of a password; or adding or omitting characters to the beginning or end of a password. By instituting an autocorrect scheme, the researchers said in their paper that they could reduce common mistakes and user frustrations with logins. Recently, an anonymous user asked Slashdot how one creates a highly secure password after a study from Carnegie Mellon issued a warning about common user misconceptions. You can engage in the conversation and/or read the witty responses here.
Half of what TFA is suggesting is, essentially, making passwords case-insensitive. Which as far as I'm concerned is a good thing, I despise case-sensitivity in all its forms in computing, to a human filename is the same as Filename and FILENAME. It's only binary technical smart-asserry that distinguishes them. (I'm a C# coder and I have no problem with the IDE auto-correcting and formatting the cases on my variables so that code is readible and consistent, thus avoiding compile errors)
If you don't risk failure you don't risk success.
If common problems include Caps Lock being on and the first letter being capitalised, sounds like the user frustration is with the input device.
We don't need more Clippy, "It looks like you're trying to enter a password - would you like some help with that?" Just make sure that it's obvious for the user how to do exactly what they want to do, and stop "helping" them. Artificial intelligence is almost always a hindrance. Hell, I spend more time correcting auto-correct than being corrected properly by it - it's more a source of amusement than a useful function. (Mind you, the first thing I do when installing a word processor is turn off live spellcheck - if I don't know how a word is spelled, I don't know whether I'm using the right word. If I am using the right word, it's useful to know how to spell it.)
I just let pwgen generate my passwords. I basically use two: low sec (e.g. my login passwords) are eight characters, hi sec (hd and backup media encryption, ssh key passphrase, bank token) are 16 characters.
I just generate one, i.e. I don't pick a "nice" one, so I'm out of the equation.
I memorize them. I never use the same password twice.
Seldom used passwords are in an encrypted file. Passwords I use frequently are just in my head. I don't even trust firefox with them (heck: I trust my browser with as little as possible).
At first, memorizing a 16-length pwgen seemed hard. These days it just takes me about two days. In this time, I carry it on a little paper slip in my pocket (I'm especially vulnerable at these times, like a lobster changing its skin: I love this image :-)
I had a phone with a bad habit of prepending a space a lot of the time when you start typing in a field. Yes, it was terrible software and it shouldn't have existed, but you have to deal with what you're stuck with. It would have been nice to have something like this.
Going to wait for smarter people to weigh in on what it actually means for security, but it always seems like bits of entropy isn't all that important compared to 1) preventing brute force with rate limiting, 2) enough complexity to avoid dictionary attacks while still keeping your rate limits non-punishing, and 3) at least a token effort to make things hard to keyboard surf.
Captcha: twitter, where I just got compromised a few days ago. I probably reused a password from LinkedIn, and they probably let you log into Twitter by email address.
It seems that all major research starts on XKCD...
Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
I saw an article once talking about how Facebook stores both your hashed+salted password and its case-flipped version. So, leave capslock on and it'll match, for a pretty small loss of protection.
In my country, along with caps lock, many people will switch between local and English keyboard layout so instead of 123 they will type ÄÅÄ. Another one back home is qwertz versus qwerty. I wish someone implemented this a long time ago along with the 'caps lock ignore' feature. By the way, it is quite unlike case insensitivity because you just accept two versions - Password and pASSWORD - pAsswOrd would not be accepted. That actually till keeps the security pretty high I would say, with a decrease of the search space to one half of the original for each 'forgot to switch' factor.
If this ever starts to take hold it might really screw up those people who use the same password in multiple places. If I use a password frequently in a place where autocorrect is implemented, I might re-memorize the password incorrectly both in mind and in muscle memory. Then, when I enter the 'same' password in the place where I use it less frequently, and where autocorrect isn't implemented... OOPS!
'The Economy' is a giant Ponzi scheme whose most pitiable suckers are the youngest among us and the yet-unborn.
So instead of just making sure the user learns from the bad input, we'll just let them go ahead.. Sorry, but to me it's just stupid, yes it might be annoying at times, but if it happens a lot, then you might want to consider fixing the problem yourself and not let a system help you with your own faults during entering the password.. If the capslock is on, just tell the user the capslock is on, not help them circumvent it..
Instead of weakening passwords by assuming that some combinations are errors, let's fix the main cause of password typos, the masked entry field.
Think back on the last hundred times you logged into something with a password. Other than at the ATM, in how many of these cases could someone have been looking over your shoulder? The only times when you need a masked field is when you're standing at a dedicated device with people lined up behind you. On computers, a 'mask this password' checkbox option will cover that occasional instance when you're in a public environment.
Can be done easily in many languages and doesn't reduce security like this would.
It's annoying when I type to fast and punch in 12346 and I have to retype my password.
Testing and displaying the status of caps lock is a generally good idea, as long as it is done unintrusively (some people DO use caps lock). I do also like trimming password strings off their leading or trailing spaces. The rest... Well, if some javascript shit starts reading a password, it is just so easy to send it wherever...
What surprises *me* is that typos aren't measured as a marker of password complexity. I expect that one day I'll log in to a dialog that says:
"You've only entered an incorrect password once this month; your password is obviously not hard enough. You have to change it."
They are not proposing a special class of passwords, but a login system that fuzzes the submitted password and checks the hashes of a small number of variants. This seems safe.
But what does this mean:
Facebook already has such scheme in place where it corrects capitalization errors on password submissions.
Is Facebook really comparing passwords in cleartext, instead of hashed? Because I don't see how they could "correct capitalization errors" in a hash. The server-side logic should never know the cleartext password. Ideally (but the web is not there yet) a password should never even be transmitted in cleartext.
TRIGGER WARNING: Anecdotal evidence
One of my favorite passwords was based on the word wizard. I didn't often type z's, let alone x's...I set up a new Linux box and my root account (before all this safe don't-ever-use-root-use-sudo bullshit). Trying to log on to my system the first time, I couldn't get the password right no matter how careful I was.
Finally, I decided to type it quickly and see what "muscle memory" did. wixard.
Ahh! There it was, a simple typo (I had to type it at the prompt to see what the text actually came out to be), but made my "wizard130" intended password a little bit stronger: "wixard130". Not much, but a bit. Me and a buddy used variations on that for years. I still use it on some of my offline Linux boxes because that's one that I'll never forget.
Autocorrect be damned; let the users mess up their own shit and quit automatically fixing stupid.
The problem here is people are making the assumption that entropy exists where it doesn't. Is a capital letter required in your password that should almost double the possible combinations per letter of password right? However if 99% of the people will make it the first letter and only the first letter suddenly you've gained almost nothing.
Congratulations, you just made shoulder surfing even easier.
Computer: > Password
User: > Rameses
Computer: > Uh, you want to tack on anything there buddy?
User: > 2?
Computer: > Come on in
The Quirkz Handbook of Self-Improvement for People Who Are Already Pretty Okay
Maybe they can apply this to those terrible security questions. Was my high school mascot the Cardinals or the Red Cardinals? Which one did I type when I was first asked this question, because we used to call ourselves both when I was in school. And did I capitalize it? And did I pluralize it? I got locked out of an important system because of this, and it was a system that didn't need that level of security.
Secession is the right of all sentient beings.
Given that Dropbox has previously considered passwords to be optional, I'm not convinced that Dropbox engineers adds much credibility to this research.
http://techcrunch.com/2011/06/...
And how are they hashing the passwords if they are allowing for typos?
I spent 15 years developing a log in and security system used by about 80,000 web sites, and have had the opportunity to analyze millions of log in attempts. Based on that experience, heres what I do. People copy-paste user names and passwords and when they do, they get extraneous spaces at the beginning and end. So we trim spaces from the beginning and end (not the middle).
Some people use caps lock when they set their password, but most don't, so we show a big warning message if caps lock is on. Later, gdm (the Linux log in) started doing the same.
20 years ago I was working on a SunOS setup, and we would periodically crack our own users passwords to let them know when they were vulnerable.
I don't recall the specifics, but one user was failing with something like 'Password'. The user was befuddled because they swore they used much longer passwords with a bunch of hardening tacked on the end. They had been dutifully typing the 20 character password they had selected, not knowing the SunOS system at the time would truncate to 8 and check only that.
Anyway, the discussion around 'helpfully' automatically helping user have an easier password reminded me of that. Our systems were 'helpfully' allowing users to mess up things after the first 8.
XML is like violence. If it doesn't solve the problem, use more.
(Locking out the IP address is another matter in most cases).
That still allows a bad actor behind a carrier-grade network address translation (CGNAT) to DoS a hundred legitimate users behind the same CGNAT. And with IPv4 address exhaustion, many mobile ISPs and ISPs in late-developed countries have deployed CGNAT so that the Internet can have more than 4.2 billion users.
From now on, my systems are going to require that all passwords include an emoji character.
Crack that, you rotten blackhatters!
And while we're ranting about capitalization and special characters (%$*&#), why not just give up and realize that everything inside a computer is 1s and 0s? Require all passwords to be a string of at least 110111110111 1s and zeros.
https://app.box.com/WitthoftResume Code: https://github.com/cellocgw
http://www.newser.com/story/21...
What's a BOFH to do? With auto correct this could cut down trouble calls a lot. It's a BOFH's highlight of the day to get those calls.
http://bofh.bjash.com/