There is a widespread tradition of generating password by accumulating semi-magical operations which are assumed to "look secure". Basically, we cannot reasonably measure how much a private function is private for a randomly selected word in a specific list, we know how much it is unknown to the attacker: the attacker knows the list, not the randomly selected index. The only sane way to compute entropies is to assume that the attacker knows everything whose confidentiality cannot be quantified. The whole point of entropy calculations is to come up with a good, mathematical, reliable measure of security. and with a "private function", that's nigh impossible. Will the gain in security be sufficient to offset the extra effort ? To answer that question, you must know that "gain in security". Your "private function" will have to be run in your head regularly. as time spent, or as accumulated exasperation at dumb software). In a business context, costs translate to money but even for private individuals, costs exist (e.g. For instance, a password implies costs, in particular the time spent by the user to actually type that password. You need that information because that's the only way to know whether your security controls are worth the effort. If the said function exists as a script or executable file somewhere, or as a textual description on some blog post or policy document for users, then it is inordinately optimistic to believe that the attacker does not know it.Ī big part of password security, even of security in general, is to know what kind of "security" you actually achieve. Even if you can come up with some "mixing" procedure that lives in your brain only, it is quite hard to quantify how much that procedure is unknown to the attacker. Well, such a beast does not really exist. Plus the huge advantage of the xkcd style is that it's easy to remember and type. Even if you know everything about how I generate passwords (including the list of words I use) there are still 2^44 possible passwords. This is a great asumption and it is used in the xkcd comic. Kerckhoffs's principle is often used in cryptography and states thatĪ cryptosystem should be secure even if everything about the system, except the key, is public knowledge. Is your system still more secure? No people will be looking for csbthaapolteotrerrryseect and similar passwords. They are targeting you and know your function, or maybe your function becomes wildly popular (like the xkcd one has) so the attackers run your function over their dictionary. Is your system more secure? Yes, csbthaapolteotrerrryseect is unlikely to be in a password dictionary.Ģ) Attackers have downloaded a database of usernames and passwords with all the passwords stored as SHA1 hashes. They use rainbow tables or a dictionary of common passwords and try to break the weak passwords. Consider the following two scenarios.ġ) Attackers have downloaded a database of usernames and passwords with all the passwords stored as SHA1 hashes. This is a classic example of Security through obscurity which while it may work sometimes is considered a bad idea because it never works out in the long run.Īs in my answer to the other question it comes down to threat modeling.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |