Hacker News Reader

Comment by als0 | Hacker News Reader

What I never quite understand is how this can work in practice. When someone is under real duress, they do not always behave in a logical way and may be too stressed to remember certain details like a password that they never use...

View on HN

I completely agree. I have long passphrases.

The only way I can imagine remembering a duress passphrase is to make it slightly different in some way.

So that means I'd have to keep updating my duress passphrase alongside my regular passphrase.

Either way I love this idea and I might actually start using it. I'm just trying to figure out how to set a practical passphrase I will be able to remember. My passphrases generally are in muscle memory after having entered them for a few days.

Edit: A simple system I just came up with is to use one of the numbers in the passphrase and increment it by one to indicate each level of duress.

Interesting idea. I find that it's pretty hard to modify the end of a password though, I'm likely to press enter rather than add anything else. Probably a good idea to change the first character, so you have the rest of the password to remember that you're supposed to do that.

You don’t understand how someone can remember a password under stress?

If you used that password twice two years ago when you installed the module and you're suddenly pulled in an interrogation room in a foreign country? When you have about one chance to enter it right while some very angry officers look over your shoulder?

I can absolutely see that.

This is why usually these trigger-passwords are just a variation suffix away. If your real password was 123456 + Ok a system like that would trigger if you e.g. append a certain sign to it: 123451 + Ok. So you don't have to remember a different password, you just have to remember the one character or button that makes it call security.

Maybe using a prefix would be better. Similar ease of remembering it but you won't have to fight your muscle memory at the end of the password.

Reply on news.ycombinator.com