Re: Password Difficulties

ben@Tux.Music.ASU.Edu and joshua@cae.retix.com both suggest ways to
choose passwords/phrases--things no normal person will do.

What do we do about a population which thinks a 4-digit PIN is secure?
If people use their current ATM PINs--and a lot of computer users *do*
when they are allowed--there will be problems: if we want privacy we
had better figure out how to give everyone privacy.

Part of my original post was cribbing from a paper I once read on the
security of crypt on Unix machines.  It talked of multiple
applications of crypt to slow down brute-force password cracking.
Should things like PGP use this technique in protecting the secret
key?  Does a million encryptions equal 10-bits added to the key?
(Assuming the million encryptions cannot be composed into a single
equivalent encryption.)

-kb


--
Kent Borg                                                  +1 (617) 776-6899
kentborg@world.std.com                                
kentborg@aol.com                                      
          Proud to claim 31:15 hours of TV viewing so far in 1994!

>What do we do about a population which thinks a 4-digit PIN is secure?
>If people use their current ATM PINs--and a lot of computer users *do*
>when they are allowed--there will be problems: if we want privacy we
>had better figure out how to give everyone privacy.

There's a difference: as far as I know, ATM PINs can't be cracked
offline (somebody correct me if I'm wrong). The big problem here is
that you have to assume the attacker can do his thing offline. Require
an online trial for every test key and it becomes much easier to
detect this sort of thing.

Phil

(I think Kent Borg wrote this)

> >What do we do about a population which thinks a 4-digit PIN is secure?
> >If people use their current ATM PINs--and a lot of computer users *do*
> >when they are allowed--there will be problems: if we want privacy we
> >had better figure out how to give everyone privacy.

Fact is, most people never think about real security.

Safe manufacturers have said that improvements in safes (the metal
kind) were driven by insurance rates. A direct incentive to spend more
money to improve security (cost of better safe < cost of higher
insurance rate).

Right now there is almost no economic incentive for people to worry
about PIN security, about protecting their files, etc. (Banks eat the
costs and pass them on...any bank which tried to save a few bucks in
losses by requiring 10-digit PINs--which people would *write down*
anyway!--would lose customers. Holograms and pictures on bank cards
are happening because the costs have dropped enough.)

Personally, my main interests is in ensuring the Feds don't tell me I
can't have as much security as I want to buy. I don't share the
concern quoted above that we have to find ways to give other people
security.

(And to think people call me an elitist!)

--Tim May



-- 
..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,  
tcmay@netcom.com       | anonymous networks, digital pseudonyms, zero
408-688-5409           | knowledge, reputations, information markets, 
W.A.S.T.E.: Aptos, CA  | black markets, collapse of governments.
Higher Power: 2^859433 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."

[etc.]

> > >What do we do about a population which thinks a 4-digit PIN is secure?

[etc.]

> Fact is, most people never think about real security.
> 
> Safe manufacturers have said that improvements in safes (the metal
> kind) were driven by insurance rates. A direct incentive to spend more

[etc.]

Speaking of safes and the psychology of passwords....

A very funny (and scientifically interesting) book is:

_Surely You're Joking, Mr. Feynman_

One of its chapters (entitled "Safecracker" if my memory serves)
discusses the locking file cabinets and safes used by the scientists
working on the Manhattan Project (_big_ bomb).

Richard P. Feynman took great joy picking, cracking and otherwise
bypassing these security measures.  He got no end of joy guessing
passwords (combinations) based on the personality of the safe owner.
The first digits of pi and e were common....

One very high military muckety-muck spent a great deal of money for
a walk-in safe with very thick, hardened steel walls.  (Since 
the importance of secrets is obviously proportional to rank!)
The high muckety-muck never took the time to change the default
combination....

The math is easy; its the cultural side of crypto that tough!

Cort.

P.S.  There is a compact disk recording available of the late 
Mr. Feynman actually telling this story (along with some of his
famous bongo music).  It is a treasure if you are interested in
that sort of thing.  I don't have the address of the publisher,
but it can be found somewhere in the second biography of RPF.
(Something like, _You Can Think for Yourself_...????)

> (Something like, _You Can Think for Yourself_...????)

Actually, it's entitled "What Do I Care What Other People Think".  I'm
not sure which one I like better, however in the first book, when he
talks about hiding the door, and decribes where he put it, well, I
followed those directions and found the spot.  (Unfortunately the
house has since been renovated, so the exact room isn't the same)

-derek