Amazon.com Security Flaw Accepts Passwords That Are Close, But Not Exact

Re:Amazon.com Security Flaw Accepts Passwords That Are Close... by johnswamps on Friday January 28, 2011 @08:50PM (#2154331)

If done deliberately, could this be a useful feature so that users can typo a password (say levenshtein distance <= 1 or 2) and still login? Obviously the major downside is that you would need a longer password to get the same level of security and it could be difficult to implement especially since the password should be hashed. Is this feasible? I'm guessing the answer is no, but was wondering what other people thought.

[ Parent | on HN ]

Re:Amazon.com Security Flaw Accepts Passwords That Are Close... by epochwolf on Friday January 28, 2011 @09:50PM (#2154470)

Only if you want to store all the passwords in reversible encryption* or do some crazy scheme which you check every possible combination of hashes within the distance of the current password.

* If I find out you've been storing passwords in plain text I will hunt you down and slap you. :)

[ Parent | on HN ]

Re:Amazon.com Security Flaw Accepts Passwords That Are Close... by Retric on Friday January 28, 2011 @11:40PM (#2154651)

I don't think checking every hash within one of the password is going to cost much, worst case your checking less than 1,000 passwords. However, I would much rather a system that checked 2 passwords one with and one without the caps lock on. AKA 1Password and 1pASSWORD.

[ Parent | on HN ]

Re:Amazon.com Security Flaw Accepts Passwords That Are Close... by nbpoole on Saturday January 29, 2011 @02:15AM (#2154953)

"I don't think checking every hash within one of the password is going to cost much, worst case your checking less than 1,000 passwords."

If that's the case, you're doing it wrong (it being password hashing). Because if you can hash 1000 passwords fairly quickly, that's the lower bound of what a dedicated attacker can do. ;)

[ Parent | on HN ]

Re:Amazon.com Security Flaw Accepts Passwords That Are Close... by mgkimsal on Saturday January 29, 2011 @08:16AM (#2155344)

If Amazon is letting someone attempt 1000 failed login attempts, even over several hours or a day, they're doing something wrong.

[ Parent | on HN ]

Re:Amazon.com Security Flaw Accepts Passwords That Are Close... by nbpoole on Saturday January 29, 2011 @09:36AM (#2155456)

You also have to consider the possibility of an offline attack (ie: if Amazon's database were compromised and password hashes were leaked).

[ Parent | on HN ]

Re:Amazon.com Security Flaw Accepts Passwords That Are Close... by MartinCron on Saturday January 29, 2011 @12:42AM (#2154779)

Storing the CAPS LOCK and non caps lock hashes of a password seems utterly brilliant. I'm tempted to start doing that.

[ Parent | on HN ]

Re:Amazon.com Security Flaw Accepts Passwords That Are Close... by sparky on Saturday January 29, 2011 @01:11PM (#2155929)

Might improve user experience a bit, but your password hashing scheme needs to take much longer if an attacker knows he can rule out lower-case letters.

For example, 8-character alphanumeric passwords:

((26*2)+10)^8 / (26+10)^8 = 77.4

You have 77 times fewer passwords of length 8 (probably worse than that, most people skew more towards letters than numbers), so it should take 77 times longer to test one.

[ Parent | on HN ]

Re:Amazon.com Security Flaw Accepts Passwords That Are Close... by Retric on Sunday January 30, 2011 @10:34AM (#2158221)

Caps lock does not remove lowercase letters, it swaps upper and lower case. <Caps Lock> + <Shift> <a> = a.

PS: Try it: ASdf becomes asDF.

[ Parent | on HN ]

Re:Amazon.com Security Flaw Accepts Passwords That Are Close... by epochwolf on Sunday January 30, 2011 @11:43AM (#2158378)

I think caps lock works differently on macs. I remember it making everything uppercase, regardless of whether the shift key was pressed.

My Mac is running Windows at the moment and I can't reboot into OSX to test for several hours, so someoneelse will have to confirm or deny this.

[ Parent | on HN ]

Re:Amazon.com Security Flaw Accepts Passwords That Are Close... by epochwolf on Sunday January 30, 2011 @07:21PM (#2159688)

Confirmed, capslock on OSX makes all letters uppercase. Shift is ignored.

[ Parent | on HN ]