Hacker News Reader

Comment by aborsy | Hacker News Reader

The algorithms are secure.

* The hdd in a phone that is not powered off is mounted. It takes an exploit in OS to pass the Lock Screen or read the RAM.

* The vast majority of people don’t have long alphanumerical passwords. The short pins can be broken.

* Some manufacturing companies don’t handle encryption keys properly. Synology NAS stores the keys next to the encrypted data for automatic access upon boot (unless you change the default and store the keys on an encrypted USB or enter keys manually upon boot).

* There are sometimes bugs in algorithm implementations, especially if a company roles its own crypto with closed source software.

* Sometimes encryption keys are not properly generated. Bad RNGs were a thing for a long time.

* And of course there could be back doors for law enforcement.

View on HN

Except for obvious pins, they cannot be brute forced due to the throttling built-into the hw vault.

If you are referring to upper limits on password trials enforced by chips such as TPM, T2 or those in Yubikeys, these are software and hardware — but not fundamental algorithmic — limits.

I wouldn't say an HSM such as a Yubikey is secure against a government agency. But apart from that, you can take out the hard drive and deal directly with random blubs, bypassing software limits.

Of course these measures are effective against the majority of the attackers, but we are talking about FBI here.

> people don’t have long alphanumerical passwords

Do you know how long is enough? Of course 64 chars would be dope but I'm not good at memorizing things. I know it's trainable but I'm lazy too :)

My current password is a bit longer than 10 chars and I wonder if I should upgrade it.

Use an easily memorable personalized passphrase. One that's easy for you to remember and impossible for anyone else. Repeat it in your mind like a mantra for days and it will stay with you decades later.

Personally I started doing this ~2000. I still remember my first one that I gave up meanwhile because I told it to my GF at the time and we broke up meanwhile.

You can easily top 100 characters this way. Though this is not something you want to do on a touchscreen device, it's a pain there with fat fingers.

Unfortunately, Android has a maximum password length of 16 characters.

Yeah I already have a passphrase for my desktop, but for mobile I'm on GrapheneOS and it asks my password frequently enough that I don't want something too painful to enter.

90 bits, clean source, is bare minimum. Better to push up to 128 bits.

A 10-word diceware passphrase is often recommended.

If you choose a password rather than a passphrase, the bare minimum is 15 (90 bits) to 22 (128 bits) characters, upper and lower case and numbers.

Either way, purely random is key here.

Thanks.

The RNG is the backdoor always. And as said above, how you criple the entropy.

Reply on news.ycombinator.com