Re:A plastic card for easy to remember strong passwords
by jameshart on Saturday January 10, 2015 @03:20PM
(#8867779)
It's vulnerable to a known ciphertext attack, yes. But the assumption of password usage is that the password itself is never stored - the ciphertext of this cipher should itself not be available to an attacker. An attacker looking to bruteforce a compromised file of passwords is going to struggle to figure out that your password is sh(/J3HqAfQsu..u.rqf. Even if they do find it, what would tip them off that it was generated by a substitution cipher, rather than a random password generator like LastPass? The fact it ends in a letter sequence that follows the repetition pattern of AMAZON? I think that's quite a stretch.
[ Parent
| on HN ]
Re:A plastic card for easy to remember strong passwords
by techrat on Saturday January 10, 2015 @06:33PM
(#8868372)
>But the assumption of password usage is that the password itself is never stored - the ciphertext of this cipher should itself not be available to an attacker.
I think the Gawker leak alone is enough of a precedent to ensure that this can never be assumed.
Re:A plastic card for easy to remember strong passwords
by adestefan on Saturday January 10, 2015 @05:13PM
(#8868139)
> But the assumption of password usage is that the password itself is never stored...
That's a bold assumption.
Re:A plastic card for easy to remember strong passwords
by pmontra on Sunday January 11, 2015 @07:17AM
(#8869776)
With such degree of character's reuse you must trust the attackers are not the admins of a site where you use those password, because they can look at the cleartext entered on the keyboard. Obviously this is still an improvement over using the same password123 for every single site but those nasty admins could easily check if a password ends with characters matching their domain. Then all the schema falls apart.
Re:A plastic card for easy to remember strong passwords
by nsgi on Saturday January 10, 2015 @09:47PM
(#8868832)
An attacker might setup a malicious site to collect passwords. They could also modify the server to record passwords when the user logs in.
Re:A plastic card for easy to remember strong passwords
by sago on Sunday January 11, 2015 @11:35AM
(#8870356)
You also have to totally trust the company making the cards. Who'll also know your email address and name. Maybe this particular company is legit, but seems like an obvious scam to set up something like this and have your victims basically set their passwords to what you tell them to.