This is a substitution cipher and it's not very secure. Consider what we can do if we compromise the Amazon password that's given as an example on the website:
sh(/J3HqAfQsu..u.rqf
Since the password came from Amazon, we know that the last 6 characters are "Amazon," which tells us that:
. = A
u = M
r = Z
q = O
f = N
Now we can start attacking the codeword, which are the characters between the 8-character "space bar code" and the website name:
AfQsu.
Using the letters we already know, we can determine that the codeword is:
_N__MA
It's probably a dictionary word, and we know that the blank spaces don't correspond to any of the letters we already know. According to the following command:
...the only possible codeword is "engima," so now we know that:
A = E
Q = G
s = I
Combine with another compromised password, and we're coming dangerously close to being able to generate a password for any arbitrary website.
Edit: I agree with the replies that this is an unlikely attack considering how passwords are typically compromised. And it's probably better than how most people choose passwords. But the website claims that this generates "very strong passwords," which is nonsense.
In other words, this card is cryptographically nonsense.
On the other hand, nearly every attack against passwords is non-targeted, software trolling for matches with word lists and such. A user of qwertycard is paradoxically safe, especially as single password (from for instance hacked database) does not contain telltales of being generated by substitution cipher.
In order to be in danger someone would have to either do some mathematical analysis, someone should have already tools looking for substitution ciphers, or someone should set up some application (scripts, whatever) to look for substition ciphers and break them.
Now the crucial part: No one bothers. Typically almost 9/10 of the targets use the same "catdog123" password on every site. They will be used because it is less work.
Unless you are in a risk of targeted attacks, these cards actually can improve your overall security, even despite the flaw in logic. (Which could be mitigated by the way, there are several ways to that.) In other words, non-geeks can benefit from this. My mom could.
This sort of objection is raised whenever basically any mechanism for remembering strong passwords is presented. Much like many results in computational complexity, worst-case results are not necessarily indicative of real-world utility. To wit, in the scenario you outlined the attacker must a) know beforehand that the target was using this device; b) know beforehand that the inserted middle portion was vulnerable to a dictionary attack; c) have compromised at least one and more likely several websites; and d) obtained the cleartext password from each of said websites. This seems an almost comically unrealistic chain of events for the average case. Yes, a determined and sophisticated attacker could probably pull this off, but if you have enemies who are willing to go to such lengths you probably are aware of it and would not be using a silly little crutch in the first place. For the rest of us, this seems like a potentially useful alternative to using 'c@td0g11!' for everything.
> This sort of objection is raised whenever basically any mechanism for remembering strong passwords is presented.
Yes, because we've basically realized that memorizing passwords isn't a workable solution. We should be recommending password managers that generate/store strong passwords and MFA for any account that needs to be secure. That these password generators themselves can now be unlocked using both memorized information and biometrics (TouchID and such) makes them all the more secure.
Moreover, this is the only solution that's capable of dealing with all the asinine password requirements that get imposed on users...solutions like this card fail hard when the password requirements prohibit certain characters and/or other characteristics of these passwords (repeated characters, length, etc.) Until the world gets together and standardizes what constitutes a secure password, memorized passwords will always be a flawed solution.
They have been through history and way before the industrialized world, not only that but what was considered secure yesterday may be compromised today or tomorrow. This is not going away any time soon and you have to design security taking this into account.
Another problem with password, it's that those web services we use password for collect way too much sensitive information that they should not be given in the first place.
yea a coworker uses YubiKey... it generates extremely strong one-time-use passwords (essentially just meaning it auto-generates a different one for every site?) & auto-enters them through a browser add-on when the device is in USB (I believe?)
seems like solutions like that are a bit easier than typing in a bunch of keys you are looking up on a card and really solve the issue of web-based attacks.... it really only leaves you vulnerable to people who have physical access to the USB device, and even then i can imagine simple ways to make even that a hassle (have another password layer as master sign-in? would be enough to deter most of your acquaintances from being able to use your device)
A normal Yubikey is still vulnerable to MITM and phishing attacks.
The combination of a password (using a password manager) and a U2F key is more secure (Yubico also has U2F keys). U2F keys avoid phishing and most MITM attacks by generating a unique keypair per origin. Since a phishing site or MITM does not have the same origin, they cannot successfully complete a challenge-response with the key.
Also, AFAIR, Yubikey OTP requires the use of a Yubikey server which knows the shared secret, which may be problematic.
No! Passwords should never be considered as secure material, period. Centralizing in a password manager centralizes the burden. There are half a dozen other workable solutions, among which authentication by email (What else is the reset-by-email link?), Mozilla Persona and all kinds of asymetric keys.
It is better than using the same password everywhere, but not by much.
When password databases are leaked, there have been instances of people / groups who take passwords from those leaked databases and try to log in on other sites (for example, to steal money or data, defraud customers, or to plant back-doors to allow future criminal activity).
Suppose that after this becomes popular, there are leaks of at least two plain text databases from popular websites (not that unlikely, unfortunately). These websites might be relatively low value - someone might get permission to comment as someone else, our change their preferences on the site, or something like that, if they had their password. Suppose some people believed this card was safe, and so put a password generated by this card into two of these low-value sites that don't put too much effort into security (since they don't even bother hashing their passwords with bcrypt / scrypt or the like), and also into a high-value site (bank, domain name registrar, GitHub account that hosts puppet scripts, important e-mail account).
Using the two low-value site password databases, I could easily automatically identify likely candidates for these types of passwords that are common between the two databases - they both start with the same 8 'spacebar' characters. I could have a set of likely endings prior to the substitution cipher for the passwords in each database, and this would allow me to use something like the E/M algorithm to work out a distribution of most likely partial substitution cipher table, common word, and space bar values, which I could then combine with likely 'identifier' plaintexts to prioritise the order in which I send passwords to use against the secure site.
All of this would likely be completely automated - and if a significant number of people are using these cards, for certain types of criminal enterprise there is a good chance that it would be cost effective.
All in all, people using this card are taking a very real security risk that is completely unnecessary when there are other better alternatives (like using a password manager, and generating a completely different secure random password for each site). Encrypting the database with a strong password and an expensive key derivation function also complicates other types of attacks (for example, someone secretly going into your wallet and photographing the card) - obviously, they could try to install a keylogger on your phone or computer with the password database, as well as copy your password database, but that probably takes longer and carries more risk of getting caught than photographing a card.
Please do apply this sort of objection to a password card[1].
Then again there are different kinds of attack on passwords, among those is the dedicated targeted attack and those will be happy to exploit the false sense of security you get from a qwerty card.
Lastly using the same password for everything is wrong, but reusing a password for services that do not require a high level of security is acceptable such as posting comment on weblogs. bugmenot being a popular choice reminding of a time when their website was actually useful.
The rest of us could also make up our own password generating techniques as well, and have c@td0g11!el8oo8, c@td0g11!no5@m@ etc.
el8oo8 is google backwards - but coming up with a word scrambling technique isn't hard, as many conspiracy theorists ought to know better.
This wouldn't provide cipher encoding, but someone already mentioned https://www.passwordcard.org/, and as you said, this is for the rest of us.
There is no need to even break the codeword as it is the same for every site. In the above example say we want to guess their gmail password, it is probably:
sh(/J3HqAfQsu.?u.??
We have only three characters to guess!
OTOH this is only relevant for targeted attacks where the attacker has one password. This still protects you pretty well from bulk attacks (so long as the card is not widely used) and is miles better than re-used or poor passwords at little usability cost.
The site is only an example. You would actually order your own unique card to carry with you. No one would be able to guess your password since your spacebar code is unique to your card.
That doesn't change the GP's point. One compromise means that password and spacebar code is compromised for all passwords. Other comments have already addressed how wimpy a substitution cipher is. Add to that that you can't reasonably cycle keys here, and you have yourself one pretty terrible password system.
This is wishful thinking, factor in the actual organization doing global surveillance and spying, say NSA who is known to intercept hardware to flash firmware with backdoors and suddenly the need to guess is no more, your card can be legally copied at any point between production or transportation to you.
Oh my god, if you really worry about NSA hacking your accounts, then probably this card is not for you. And they probably don't need to guess your passwords, they can just get in with a court order. This is for people who are still using passwords like "password12345" because ".;l[ppop[o#@!" is too hard to remember.
What is the point of decoding this back into the user's original "ENIGMA" and "AMAZON" strings? In this case, "sh(/J3HqAfQsu..u.rqf" is the user's password. If you have that, there is nothing to crack.
Edit: I see "Combine with another compromised password, and we're coming dangerously close to being able to generate a password for any arbitrary website.", which means that if an attacker could obtain a couple of these passwords, they could determine (a lot of) your qwertycard and gain access to more of your accounts.
However, by the time an attacker has any of your passwords, I'm not sure that reverse engineering your qwertycard is an issue. As others put better than I, this would also mean that in addition to obtaining one or more plaintext passwords, the attacker would have to be targeting you specifically and know how you generated the passwords.
Not necessarily, if this card ever gets popular enough that it's worth the trouble in a first place, cracker can simply presume that at least some of the leaked passwords are created with it. He can then just go though the passwords one by one, decipher the last segment (this can be done very quickly), substitute it with the encrypted email domain (the email is also in the leaked DB) and check if the login works. If vulnerable passwords are in the DB they will all be found, and fairly fast, too. Once the cracker gets access to you email account all your bases are belong to him, he can then get even into the sites where you didn't use the password card at all, simply by using the forgotten pass link.
Alice is a system administrator of xyz.com. She has access to the password that Bob uses on xyz.com. By reverse engineering Bob's password on xyz.com, Alice can then attack Bob's account on pqr.com.
It's vulnerable to a known ciphertext attack, yes. But the assumption of password usage is that the password itself is never stored - the ciphertext of this cipher should itself not be available to an attacker. An attacker looking to bruteforce a compromised file of passwords is going to struggle to figure out that your password is sh(/J3HqAfQsu..u.rqf. Even if they do find it, what would tip them off that it was generated by a substitution cipher, rather than a random password generator like LastPass? The fact it ends in a letter sequence that follows the repetition pattern of AMAZON? I think that's quite a stretch.
>But the assumption of password usage is that the password itself is never stored - the ciphertext of this cipher should itself not be available to an attacker.
I think the Gawker leak alone is enough of a precedent to ensure that this can never be assumed.
With such degree of character's reuse you must trust the attackers are not the admins of a site where you use those password, because they can look at the cleartext entered on the keyboard. Obviously this is still an improvement over using the same password123 for every single site but those nasty admins could easily check if a password ends with characters matching their domain. Then all the schema falls apart.
You also have to totally trust the company making the cards. Who'll also know your email address and name. Maybe this particular company is legit, but seems like an obvious scam to set up something like this and have your victims basically set their passwords to what you tell them to.
SuperGenPass[1] seems to be a much better alternative to this, since it actually hashes your codeword with the website domain. Though it too has its issues (uses fast hash functions, running it as a bookmarklet is problematic too–better to run it offline).
Still, completely agree with this:
> I agree with the replies that this is an unlikely attack considering how passwords are typically compromised
It's always going to be a trade-off. Ultimately any scheme that gets people to use better passwords, even if flawed, must still be an improvement over the alternative of post-it notes and birthdays... there's no such thing as perfect security, as we keep being told.
You are making a rather critical mistake; you are not realizing that not only are the character associations variable, but so is the "space bar code", which will be unique for each card.
The point being that, although not impossible, it is far more complicated to break the code than you describe here.
You are also assuming that everyone will use the full name of the site, e.g., AMAZON, and not simply AZ or AMZN or AMA. For example, I may use YC or YCOMB or YCOMBINATOR for this site, which would also increase the combination exponent..
> You are making a rather critical mistake; you are not realizing that not only are the character associations variable, but so is the "space bar code", which will be unique for each card.
I don't know what you mean by "variable" "character associations," but note that my analysis doesn't depend on the space bar code at all, except assuming that it's the first eight characters, which the site's FAQ guarantees. Otherwise my analysis completely ignores it.
> You are also assuming that everyone will use the full name of the site, e.g., AMAZON, and not simply AZ or AMZN or AMA. For example, I may use YC or YCOMB or YCOMBINATOR for this site, which would also increase the combination exponent..
True, but there are only a handful of logical choices for any given site.
In any case, this is just haggling - the point is that attacks like this shouldn't be possible at all for something claiming to generate "very strong passwords."
I think I'd like PasswordCard because it's pretty freeform - just pick a starting point and a visual direction/pattern and copy letters from the card. But honestly I don't much like the idea of relying on a physical token if I don't need to. Almost losing my 2FA last year was a bit scary.
Except it's not going to work, because of the bank who doesn't allow '(' as a special character, or the ticket website that requires at least 3 digits, or the financial firm who only allows 8 character passwords. As soon as you have a few sites with 'rogue' password policies, the system breaks down.
I tried going to a similar algorithm of my own invention some years ago, and ran into this exact problem. Mostly sites that don't allow certain characters (which is asinine). Now I have a few different algorithms that I use that are friendly to common password requirements, and I keep a list of which algorithm I used on each website, rather than just a list of the passwords. Since the algorithms only exist in my head, I think it's secure enough for most purposes.
There are ways around it: using the code for the key directly north-west of the problematic character, and if that's a bad character go further, maybe wrap around, or try to follow through the problem character (a/& -> &/| -> |/f, thus f would be the code for a) etc.
As for remembering which sites have what restrictions, I can keep that stuff in my head (looking at you Microsoft), but I guess you may have more accounts than me. Then again, when a password fails, then all you'd have to do is retry with a safer version (and maybe only have two password kinds, for convenience - full-blown char support, and minimalistic lowercase-letters only, so you'd only have to retry a single time after the first failed login).
Personally, my biggest problem with this card is that it doesn't provide enough value.
> Then again, when a password fails, then all you'd have to do is retry with a safer version
And after three or five failed login attempts you get locked out and have to call the bank for a password reset, and throw away the damn card in frustration.
> (and maybe only have two password kinds, for convenience - full-blown char support, and minimalistic lowercase-letters only, so you'd only have to retry a single time after the first failed login).
If you're authenticating with more than HN and Reddit, you'll encounter much more than two mutually exclusive password policies.
Nah man, don't sweat it this case is thoroughly covered in their faq: you can petition those firms by tweeting them with #strongpasswords hashtag and @qwertycards.
Yeah, qwerty card are badly thought out, they know of the shortcomings and they don't care much as they're in this business for the money.
Besides other problems (like not working with certain password requirements), this particularly doesn't work when a site forces you to reset your password because of a breach or time limit or who knows what. (Yahoo just forced a mandatory password reset on me today, without even giving a reason except to "protect my account".)
Then you've got to remember -- are you now on amazon3 or amazon4 or gmail4 or gmail5? And then it defeats the whole purpose of the card.
What prevents me from using this type of strategy is the inconsistent adoption of password requirements.
For example, some of the websites I use require passwords to contain at least one capital letter, or a digit, or a punctuation mark (e.g. ! ? #, etc.). But other Website do not allow punctuation marks or digits.
Some require a password of a minimum length, but a dwindling few can only accept fairly short maximum length password.
Wait really? It feels like almost every time I make a new account somewhere and drop in the 200 character high-entropy password that LastPass generated, I get a silent failure or misleading error message about "your username was not recognized." Then I try guessing which feature of my candidate password is pissing off the site: Is it the whitespaces? Special characters? Length?
This is particularly maddening because there are plenty of ways to accept arbitrary passphrases from users.
Obviously the longer the maximum available length the better but it does assume the host computer always has the password manager installed. I'd shudder to think how such a long password would be entered otherwise.
It's rather ironic this site is all about strong security, when their SSL/TLS settings are terrible. (Including being open to the POODLE and OpenSSL CCS vulnerabilities)
Thank you for bringing this to our attention - we’ve now upgraded the server to address this and will continue to monitor carefully for any other issues.
If the end goal is to turn a long, comprehensible password like "correcthorsebatterystaple" into something not remotely subject to a dictionary attack, then merely shifting your fingers over on the keyboard by one key is much more convenient: "vpttrvyjptdrnsyyrtudys[;r". Sure, it suffers from the same short-comings as mentioned above (it's still a substitution cipher), but it's much more convenient than going to the card for each individual letter. "vottrvyjptdrnsyyrtudys[;r" is as quick to type as correcthorsebatterystaple but much™ more™ secure™.
This is a simple variation that I have not seen covered in hashcat, though it is not future proof. If people catch on this then it won't be long before a new rule is added to hashcat to cover this case.
I have used a similar variation in the past, in my case the character substitution came from changing the keymap of the keyboard.
for example 'correct' typed in qwerty over a dvorak keymap became 'krpp>ky'
That's all well and good until you lose it or run it through the washing machine. Then your entire password system is gone. Any backup would need to be stored in a place that might as well be your 1Password/LastPass database.
Who is selling me this card, and with my name, address and (optional) email address, how long will it take him to crack every one of my accounts, considering that he has the key?
I actually really like this idea. I guess if your attacker did get your password in the clear (bad encryption or whatever) then they'd basically have access everything right? I mean, the number of letters at the start is presumably fairly constant, they'd know the site it was for so they could then work out the "unique secret" in the middle right?
That said, there's a certain amount of security through obscurity I guess.
Still, for any of the sites I really care about I use two factor authentication. I'd take a mediocre password and 2FA over a strong password (But happy to be proved wrong ;)
why would anyone need to know your secret? Except that it would give them more characters in the substitution cypher. The card assumes a user will keep the same secret for each site, so just keep the start of the PW the same.
How about doing Vigenere in your head? This is what I do: I actually write my passwords down in my little black book, which I carry in my pocket. I use a simple Vigenere cypher in case I lose the book. Each password is encrypted with the same master key, which I memorize.
For example, if my master key was 1234, and my password was 'baNana3', it would write down 'ayKwmy0'. When I look up the password, I shift the letters forward as I type them:
a + 1 = b
y + 2 = a (wrap around the end of the alphabet)
K + 3 = N
w + 4 = a
m + 1 = n
y + 2 = a
0 + 3 = 3
It's not too hard to advance 9 or fewer letters in the alphabet as you type.
If you physically protect your book sufficiently and don't let anyone who is a threat see it, and choose strong passwords (which baNana3 isn't for most purposes - it's only 7 characters long, and based on a dictionary word with minor modifications) then yes.
If someone willing to put in the effort to do some cryptanalysis obtains a copy of your book, then no, you are most likely not safe. Firstly, the Vigenere cipher is extremely vulnerable to a known plaintext attack on the key - if the person who obtained your book knows your password to just one site (for example, because it was lost in a compromise and published on the Internet), they can work out your master key and then get all your other passwords. Even if they don't know any passwords, if you use passwords that are not made up of equiprobably randomly selected characters (and especially if they are dictionary words), the attacker will usually be able to use that bias to work out the master key. For example, the attacker might cycle through all words in the dictionary to obtain the key that decrypts aykwmy to the word, and try the master key they obtain on other entries in your book until they find one that yields a lot of other dictionary words.
In general I really like generating passwords like this, but there are some downsides. It is difficult to change it later, e.g., if the password expires or is compromised.
my current "scheme" for creating new passwords is to simply write a long, unique passphrase with the idea that I will only remember it for the short time needed to log in after registration.
If I need to log in sometime in the future, I simply reset the password.
Sadly this is still a fail - I have found numerous sites whose fatuous restrictions on what are or are not legal entries include banning punctuation, never ending in a letter and more.
This seems an amusing and useful idea to making passwords - it's usability seems longer lived than my previous (personal) attempts (md5 hashing passwords and domain names).
In the end I need a trustable approach to storing encrypted data on my iphone - I suspect i have missed one. Any ideas?
I don't believe in these sorts of database-free password management systems. These require users to remember too much stuff and are not flexible to be used universally. And using these gets only more painful over time as exceptions etc accumulate. These issues have been discussed fairly comprehensively in the various HN threads on hash-based password managers, which share most if not all the downsides with this particular project.
This is a poorly thought out (qwerty only ?) and weak security attempt to make money ripping off the concept from the much better and secure password card at https://www.passwordcard.org/ that anyone can print themselves.
"If I'm logging into Amazon I'll find the intersection of column M and row A (the second and third letters of Amazon) and then read off diagonally 16 characters."
This would actually be very useful for my Google and LastPass password. I have everything else in my LastPass manager, but it is always trying to get into my google account from different places is difficult, so I have a rememberable password for both.
This would let me keep a much more secure password for both.
Just use random words. Memorable passwords don’t have to be weak. Five random common english words are already very strong. Just make sure you don’t pick the words by hand.
I would be very cautious about using shuf for password generation, since it doesn't use a cryptographically-secure random number generator (I just checked the source).
Edit: I see that shuf permits the use of custom seeds, so you can do the following, and it will be secure:
Except this has stopped being strong a while ago, since it has been popularized by xkcd in 2011 cracker have incorporated this scheme in their password cracking routines.
Except Schneier is just plain wrong about this. The numbers presented in XKCD comic were already assuming that the attacker has full knowledge about how the passwords are generated, including the wordlist used. This has been discussed over and over in various places, including HN. Long story short, there is no shortcuts for attacker against true random bits of entropy.
Many sites where I perform sensitive transactions require me to periodically change my password (banks, brokerage, etc.)
The Shannon entropy of the impossible to remember example password is 3.68418, which is not much better than the xkcd "easy for a human to remember" password 3.36386
Any authentication system will (and should) fail if you lose the authenticator.
That's not "shitty", that's the way it's supposed to work. A better system, to be of any value, would fall prey to the same 'weakness'. Even biometrics can change over time.
Math/Crypto allows for distributed authentication. Think bitcoin block chain, miners verify each transaction and but it doesn't rely on any single miner.
The bitcoin blockchain relies on the assumption that the mining power is honest and no single entity will hold the majority of the mining power. This has proven to be an issue with the selfish miner case and when a single mining pool reached 51% of the total mining power.
In the world of security you simple cannot assume honesty and build security on top of this assumption.
Who has access to the "random" info on those cards? How randomly are they generated? If you bought a few of them, could you work backwards to the generation algorithm?
Cool solution for folks like us. Best way to diminish password as an attack vector and secure services for the thronged masses is to reduce the number of passwords required to use the Internet. And couple a master (eg My google account) account with a second, biometric factor.
Edit: I agree with the replies that this is an unlikely attack considering how passwords are typically compromised. And it's probably better than how most people choose passwords. But the website claims that this generates "very strong passwords," which is nonsense.