In other words, this card is cryptographically nonsense.

On the other hand, nearly every attack against passwords is non-targeted, software trolling for matches with word lists and such. A user of qwertycard is paradoxically safe, especially as single password (from for instance hacked database) does not contain telltales of being generated by substitution cipher.

In order to be in danger someone would have to either do some mathematical analysis, someone should have already tools looking for substitution ciphers, or someone should set up some application (scripts, whatever) to look for substition ciphers and break them.

Now the crucial part: No one bothers. Typically almost 9/10 of the targets use the same "catdog123" password on every site. They will be used because it is less work.

Unless you are in a risk of targeted attacks, these cards actually can improve your overall security, even despite the flaw in logic. (Which could be mitigated by the way, there are several ways to that.) In other words, non-geeks can benefit from this. My mom could.

This sort of objection is raised whenever basically any mechanism for remembering strong passwords is presented. Much like many results in computational complexity, worst-case results are not necessarily indicative of real-world utility. To wit, in the scenario you outlined the attacker must a) know beforehand that the target was using this device; b) know beforehand that the inserted middle portion was vulnerable to a dictionary attack; c) have compromised at least one and more likely several websites; and d) obtained the cleartext password from each of said websites. This seems an almost comically unrealistic chain of events for the average case. Yes, a determined and sophisticated attacker could probably pull this off, but if you have enemies who are willing to go to such lengths you probably are aware of it and would not be using a silly little crutch in the first place. For the rest of us, this seems like a potentially useful alternative to using 'c@td0g11!' for everything.

> This sort of objection is raised whenever basically any mechanism for remembering strong passwords is presented.

Yes, because we've basically realized that memorizing passwords isn't a workable solution. We should be recommending password managers that generate/store strong passwords and MFA for any account that needs to be secure. That these password generators themselves can now be unlocked using both memorized information and biometrics (TouchID and such) makes them all the more secure.

Moreover, this is the only solution that's capable of dealing with all the asinine password requirements that get imposed on users...solutions like this card fail hard when the password requirements prohibit certain characters and/or other characteristics of these passwords (repeated characters, length, etc.) Until the world gets together and standardizes what constitutes a secure password, memorized passwords will always be a flawed solution.

I'll go even a step further and say:

passwords are a flawed solution

They have been through history and way before the industrialized world, not only that but what was considered secure yesterday may be compromised today or tomorrow. This is not going away any time soon and you have to design security taking this into account.

Another problem with password, it's that those web services we use password for collect way too much sensitive information that they should not be given in the first place.

People keep saying that passwords are flawed, but what else is there? Authentication depends on secret information, does it not?

yea a coworker uses YubiKey... it generates extremely strong one-time-use passwords (essentially just meaning it auto-generates a different one for every site?) & auto-enters them through a browser add-on when the device is in USB (I believe?)

seems like solutions like that are a bit easier than typing in a bunch of keys you are looking up on a card and really solve the issue of web-based attacks.... it really only leaves you vulnerable to people who have physical access to the USB device, and even then i can imagine simple ways to make even that a hassle (have another password layer as master sign-in? would be enough to deter most of your acquaintances from being able to use your device)

A normal Yubikey is still vulnerable to MITM and phishing attacks.

The combination of a password (using a password manager) and a U2F key is more secure (Yubico also has U2F keys). U2F keys avoid phishing and most MITM attacks by generating a unique keypair per origin. Since a phishing site or MITM does not have the same origin, they cannot successfully complete a challenge-response with the key.

Also, AFAIR, Yubikey OTP requires the use of a Yubikey server which knows the shared secret, which may be problematic.

You can replace the Yubikey's OTP seed with your own to bypass their server. https://www.yubico.com/applications/internet-services/gmail/

Yes, but then it won't be supported by many sites that support Yubikey OTP and rely on Yubico's servers for authentication.

> Memorizing passwords isn't a workable solution

Correct analysis,

> recommend password managers

No! Passwords should never be considered as secure material, period. Centralizing in a password manager centralizes the burden. There are half a dozen other workable solutions, among which authentication by email (What else is the reset-by-email link?), Mozilla Persona and all kinds of asymetric keys.

> Centralizing in a password manager centralizes the burden.

So does using a single email account for everything.

It is better than using the same password everywhere, but not by much.

When password databases are leaked, there have been instances of people / groups who take passwords from those leaked databases and try to log in on other sites (for example, to steal money or data, defraud customers, or to plant back-doors to allow future criminal activity).

Suppose that after this becomes popular, there are leaks of at least two plain text databases from popular websites (not that unlikely, unfortunately). These websites might be relatively low value - someone might get permission to comment as someone else, our change their preferences on the site, or something like that, if they had their password. Suppose some people believed this card was safe, and so put a password generated by this card into two of these low-value sites that don't put too much effort into security (since they don't even bother hashing their passwords with bcrypt / scrypt or the like), and also into a high-value site (bank, domain name registrar, GitHub account that hosts puppet scripts, important e-mail account).

Using the two low-value site password databases, I could easily automatically identify likely candidates for these types of passwords that are common between the two databases - they both start with the same 8 'spacebar' characters. I could have a set of likely endings prior to the substitution cipher for the passwords in each database, and this would allow me to use something like the E/M algorithm to work out a distribution of most likely partial substitution cipher table, common word, and space bar values, which I could then combine with likely 'identifier' plaintexts to prioritise the order in which I send passwords to use against the secure site.

All of this would likely be completely automated - and if a significant number of people are using these cards, for certain types of criminal enterprise there is a good chance that it would be cost effective.

All in all, people using this card are taking a very real security risk that is completely unnecessary when there are other better alternatives (like using a password manager, and generating a completely different secure random password for each site). Encrypting the database with a strong password and an expensive key derivation function also complicates other types of attacks (for example, someone secretly going into your wallet and photographing the card) - obviously, they could try to install a keylogger on your phone or computer with the password database, as well as copy your password database, but that probably takes longer and carries more risk of getting caught than photographing a card.

Please do apply this sort of objection to a password card[1].

Then again there are different kinds of attack on passwords, among those is the dedicated targeted attack and those will be happy to exploit the false sense of security you get from a qwerty card.

Now if you want a practical alternative for choosing passwords you can remember: https://www.schneier.com/blog/archives/2014/03/choosing_secu...

Lastly using the same password for everything is wrong, but reusing a password for services that do not require a high level of security is acceptable such as posting comment on weblogs. bugmenot being a popular choice reminding of a time when their website was actually useful.

[1]https://www.passwordcard.org/

The rest of us could also make up our own password generating techniques as well, and have c@td0g11!el8oo8, c@td0g11!no5@m@ etc. el8oo8 is google backwards - but coming up with a word scrambling technique isn't hard, as many conspiracy theorists ought to know better.

This wouldn't provide cipher encoding, but someone already mentioned https://www.passwordcard.org/, and as you said, this is for the rest of us.

There is no need to even break the codeword as it is the same for every site. In the above example say we want to guess their gmail password, it is probably:

   sh(/J3HqAfQsu.?u.??

We have only three characters to guess!

OTOH this is only relevant for targeted attacks where the attacker has one password. This still protects you pretty well from bulk attacks (so long as the card is not widely used) and is miles better than re-used or poor passwords at little usability cost.

The site is only an example. You would actually order your own unique card to carry with you. No one would be able to guess your password since your spacebar code is unique to your card.

That doesn't change the GP's point. One compromise means that password and spacebar code is compromised for all passwords. Other comments have already addressed how wimpy a substitution cipher is. Add to that that you can't reasonably cycle keys here, and you have yourself one pretty terrible password system.

This is wishful thinking, factor in the actual organization doing global surveillance and spying, say NSA who is known to intercept hardware to flash firmware with backdoors and suddenly the need to guess is no more, your card can be legally copied at any point between production or transportation to you.

Oh my god, if you really worry about NSA hacking your accounts, then probably this card is not for you. And they probably don't need to guess your passwords, they can just get in with a court order. This is for people who are still using passwords like "password12345" because ".;l[ppop[o#@!" is too hard to remember.

With the codeword broken, we can narrow the gmail password down to a single unknown character!

  sh(/J3HqAfQsu.Qu.s?

What is the point of decoding this back into the user's original "ENIGMA" and "AMAZON" strings? In this case, "sh(/J3HqAfQsu..u.rqf" is the user's password. If you have that, there is nothing to crack.

Edit: I see "Combine with another compromised password, and we're coming dangerously close to being able to generate a password for any arbitrary website.", which means that if an attacker could obtain a couple of these passwords, they could determine (a lot of) your qwertycard and gain access to more of your accounts.

However, by the time an attacker has any of your passwords, I'm not sure that reverse engineering your qwertycard is an issue. As others put better than I, this would also mean that in addition to obtaining one or more plaintext passwords, the attacker would have to be targeting you specifically and know how you generated the passwords.

Not necessarily, if this card ever gets popular enough that it's worth the trouble in a first place, cracker can simply presume that at least some of the leaked passwords are created with it. He can then just go though the passwords one by one, decipher the last segment (this can be done very quickly), substitute it with the encrypted email domain (the email is also in the leaked DB) and check if the login works. If vulnerable passwords are in the DB they will all be found, and fairly fast, too. Once the cracker gets access to you email account all your bases are belong to him, he can then get even into the sites where you didn't use the password card at all, simply by using the forgotten pass link.

> If you have that, there is nothing to crack.

Alice is a system administrator of xyz.com. She has access to the password that Bob uses on xyz.com. By reverse engineering Bob's password on xyz.com, Alice can then attack Bob's account on pqr.com.

Unless you use pqr<space>, or cut space in half. Then that entire design goes out the window.

It's vulnerable to a known ciphertext attack, yes. But the assumption of password usage is that the password itself is never stored - the ciphertext of this cipher should itself not be available to an attacker. An attacker looking to bruteforce a compromised file of passwords is going to struggle to figure out that your password is sh(/J3HqAfQsu..u.rqf. Even if they do find it, what would tip them off that it was generated by a substitution cipher, rather than a random password generator like LastPass? The fact it ends in a letter sequence that follows the repetition pattern of AMAZON? I think that's quite a stretch.

>But the assumption of password usage is that the password itself is never stored - the ciphertext of this cipher should itself not be available to an attacker.

I think the Gawker leak alone is enough of a precedent to ensure that this can never be assumed.

> But the assumption of password usage is that the password itself is never stored...

That's a bold assumption.

With such degree of character's reuse you must trust the attackers are not the admins of a site where you use those password, because they can look at the cleartext entered on the keyboard. Obviously this is still an improvement over using the same password123 for every single site but those nasty admins could easily check if a password ends with characters matching their domain. Then all the schema falls apart.

An attacker might setup a malicious site to collect passwords. They could also modify the server to record passwords when the user logs in.

You also have to totally trust the company making the cards. Who'll also know your email address and name. Maybe this particular company is legit, but seems like an obvious scam to set up something like this and have your victims basically set their passwords to what you tell them to.

SuperGenPass[1] seems to be a much better alternative to this, since it actually hashes your codeword with the website domain. Though it too has its issues (uses fast hash functions, running it as a bookmarklet is problematic too–better to run it offline).

Still, completely agree with this:

> I agree with the replies that this is an unlikely attack considering how passwords are typically compromised

It's always going to be a trade-off. Ultimately any scheme that gets people to use better passwords, even if flawed, must still be an improvement over the alternative of post-it notes and birthdays... there's no such thing as perfect security, as we keep being told.

[1] www.supergenpass.com

You are making a rather critical mistake; you are not realizing that not only are the character associations variable, but so is the "space bar code", which will be unique for each card.

The point being that, although not impossible, it is far more complicated to break the code than you describe here.

You are also assuming that everyone will use the full name of the site, e.g., AMAZON, and not simply AZ or AMZN or AMA. For example, I may use YC or YCOMB or YCOMBINATOR for this site, which would also increase the combination exponent..

> You are making a rather critical mistake; you are not realizing that not only are the character associations variable, but so is the "space bar code", which will be unique for each card.

I don't know what you mean by "variable" "character associations," but note that my analysis doesn't depend on the space bar code at all, except assuming that it's the first eight characters, which the site's FAQ guarantees. Otherwise my analysis completely ignores it.

> You are also assuming that everyone will use the full name of the site, e.g., AMAZON, and not simply AZ or AMZN or AMA. For example, I may use YC or YCOMB or YCOMBINATOR for this site, which would also increase the combination exponent..

True, but there are only a handful of logical choices for any given site.

In any case, this is just haggling - the point is that attacks like this shouldn't be possible at all for something claiming to generate "very strong passwords."

Aren't the cards all different? I assumed it would be a one-time-pad which is much more secure than a simple substitution.

Yes, they are different. But that just makes it a substitution cipher with unique keys.

A one time pad requires a key as long as all the messages you want to encode since each key bit is only used once.