Hacker News Reader

Comment by kretaceous | Hacker News Reader

(I'm naïve in both cryptography and ML so pardon me for the following)

I had this idea once but I never tested it:

    - Generate multiple TOTP codes
    - Make a large database with the timestamp and their corresponding TOTP codes
    - Train a model on that
    - Use it to generate MFA keys???

Of course, this wouldn't be possibly an exploit unless you steal a lot of TOTP codes from a user and the timestamps they were generated.

But fun to think about nonetheless.

View on HN

(I'm not an expert but I'll tell you what I think I understand)

As explained by other comments, secure hash functions don't behave in "predictable" ways when you change the input in a "small" way. LLMs and neural networks seem impressive at what they do best, they can tell you a human face is a human face and even describe it, and reverse the process, generate a human face from a description, and if you add an earring to the picture, it's still a human face, but if you have a file and add a byte, the resulting hash doesn't look anything like the previous one.

If your TOTP algorithm is cryptographically sound, bruteforce is the best way to crack it, trying all possible values of the shared secret until you get the same output codes, so AI/NN/LLMs/diffusion models won't help you, bruteforce just needs lots of computing power, parallelism helps, and hash algorithms are required to need a minimum amount of work so that bruteforce costs too much to perform, but not so much that it becomes a nuisance when applied (if your smartphone password manager takes a minute to open your vault and drains the battery, few people will use it).

Reply on news.ycombinator.com