Re: Password Difficulties

lcottrell@popmail.ucsd.edu writes:
>I make a point of using at least one non-dictionary word in every
>passphase I make.

Something pronouncable?  Something that follows rules of some natural
language, something short that could have been a word?

Good, but not the whole cigar.  Last I used VMS you could get it to
suggest non-word word-a-likes to use as your password.  Seems terrible
brute forcable in 1994.  

Adding a non-word to a pass phrase is like increasing the size of the
dictionary, and if you only do one non-word then only *that* word
picks up more bits of entropy in the phrase.  Yes, there are bits in
where you put the word, but the whole phrase did not become made of
deep bits.

But my point is really that even these often-less-good-than-they-look
measures are far better than what *real* people are going to do.


-kb, the Kent who wonders whether real people will ever have decent security


--
Kent Borg                                                  +1 (617) 776-6899
kentborg@world.std.com                                
kentborg@aol.com                                      
          Proud to claim 31:15 hours of TV viewing so far in 1994!

Another approach to getting enough entropy in passwords/phrases is a
"visual key" where one mouses from position to position in a visual
environment. That is, one is presented with a scene containg some
number of nodes, perhaps representing familiar objects from one's own
home, and a path is chosen.

The advantage is that most people can remember fairly complicated
(read: high entropy) "stories." Each object triggers a memory of the
next object to visit. (Example: door to kitchen to blender to
refrigerator to ..... ) This is the visual memory system said to be
favored by Greek epic poets.

This also gets around the keyboard-monitoring trick (but not
necessarily the CRT-reading trick, of course).

I haven't used one of these schemes, but I recall hearing that at
least one commercial product offers this as an option.

It might be an interesting hack to offer this as a front end for PGP.

Even a simple grid of characters which could be moused on could be an
assist in using long passphrases.

(But someone has probably patented this approach.)

--Tim May

P.S. I'm not hung up on passphrases as a major weakness. I think theft
of keys and keystroke capturing on compromised machines are much
more important practical weaknesses.

-- 
..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,  
tcmay@netcom.com       | anonymous networks, digital pseudonyms, zero
408-688-5409           | knowledge, reputations, information markets, 
W.A.S.T.E.: Aptos, CA  | black markets, collapse of governments.
Higher Power: 2^859433 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."