Hacker News Reader

Comment by icebraining | Hacker News Reader

Note, though, that accurately capturing the colors will let a bad guy brute-force the password one character at a time

How so? Since this is generated from the hash, this attack doesn't reveal more than an hash does, and you certainly can't brute-force one char at a a time from an hash.

View on HN

Assuming I record the colours generated when each character is entered, then I have a hash of just the first character. Cracking that is trivial. Then I can go and crack the second character.

There might be a tiny amount of fuzzyness if I can't exactly match the first character hash, but it would be fairly close. I suspect it would be fairly easy to write a computer program which even did this automatically, from a recorded video.

Perhaps adding a short delay (under a second) after the last keystroke before refreshing the image would make this much more secure.

Would delaying showing the colors until focus is removed from the password input eliminate this vector?

Gives a whole new meaning to "rainbow tables". Ahem!

Why not just use a video camera to watch them type on the keyboard? Plus, mobile devices show the last character typed. You're right, but this could be avoided by (for example) only displaying colors after 4 characters are typed

That reduces the problem to brute-forcing the first four characters...

I think a better solution would be to only show the colour hash after there hasn't been a keypress in a few seconds. This would likely be a pretty good way of making sure you only displayed the hash after they were done typing their password, which would prevent enabling a brute force attack.

Oh, right, I only considered photos of the last pattern, not of all of them.

Reply on news.ycombinator.com