Hacker News Reader

Hey! No, no voting ring. But I do submit a lot of ET stories, that's for sure. I only try to submit stuff that I think is new/interesting/pertinent.

I think two or three ads per page is pretty good. I have seen some tech sites with much more than that. (As you probably know, running a free site that makes money from ad revenue is pretty tough at the moment, and isn't getting any easier.)

Apologies if you find the stories lousy. I try my best to dig up interesting stuff. Obviously the quality of the reporting isn't as good as if a professional cryptographer/material scientist/engineer etc wrote it -- but... I do the best I can :)

> Apologies if you find the stories lousy. I try my best to dig up interesting stuff. Obviously the quality of the reporting isn't as good as if a professional cryptographer/material scientist/engineer etc wrote it -- but... I do the best I can :)

Um, not mentioning the "details" thankfully supplied by this comment [1] is quite a big omission.

The topic is super interesting, but it's hard to be sure if the reporting is inaccurate.

[1] http://news.ycombinator.com/item?id=4271999

To add to that, the article doesn't make it clear why torture wouldn't work...

One can torture you until you start attempting to input the password and recover it from your neurological pathways. A password is a password, it doesn't matter how you're storing it because it can be retrieved.

The problem with that is, they don't have the passphrase, so they can't put it into the game they show you. And you don't know it, so you can't enter it, even if you want to.

You can't produce the password. You can only subconsciously recognize it.

From the original paper:

   Further complicating the attacker’s life is the fact 
   that subjecting a person to many random SISL games may
   obliterate the learned sequence or cause the person to
   learn an incorrect sequence thereby making extraction
   impossible.

They can, at best, try to log in as you, record the sequence the terminal gives, have you (under duress!) play against that sequence in a remote location, determine the code, and train themselves. But that requires a login failure; this particular system is supposed to panic after even one login failure.

I don't understand. Why can't they just hand you the terminal and say, "log in or we'll shoot you"? Why the roundabout process with recording the sequence and having a failed login and all that?

Doing something with a gun at your head is, I imagine, pretty hard. Imagine something you do with muscle memory every day - maybe typing fast or editor keyboard shortcuts or somesuch. Now deprive you of sleep, and food, and make you anxious, and then have someone with a gun at your head. Are you still going to be typing as fast? With the same error rate? Are you going to be making the same keyboard shortcuts?

Having said all that, I agree it's a valid risk.

But it's extreme. Other risks are interesting to look at.

The game produces one stream of output mixed from one unique (to each player) log in sequence and some random data. So recording many streams would seem to make the real sequence available, and now you just need to simulate the player response to that input. Analysis of sound is an established technology now, having had considerable investment and research because of its military technology. Recording the sound of keystrokes (of type writers, some printers, computer keyboards) can produce accurate transcripts of what has been written.

Having said all that, I am glad that there are people researching this stuff. It's a bizarrely under-researched gap in security.

And the underlying idea seems reasonable enough. I have a few passwords that I can enter if I'm in front of my keyboard, but give me a different keyboard and I'd struggle.

Sorry for the late reply. This system isn't designed to be used on a terminal over the net. From the original paper:

    The proposed system is designed to be
    used as a local password mechanism requiring physical
    presence. That is, we consider authentication at the 
    entrance to a secure location where a guard can ensure 
    that a real person is taking the test without the aid of 
    any electronics.

And . . .

    We note that physical presence is necessary in 
    authentication systems designed to resist coercion 
    attacks. If the system supported remote authentication 
    then an attacker could coerce a trained user to 
    authenticate to a remote server and then hijack the 
    session.

If you're allowed remote attempts and multiple failures, the system is insecure in several ways. It's designed to work in a scenario where you get ONE attempt, and there's an armed guard who doesn't take kindly to it if you fail.

If the attacker has long-term control (e.g. hostage, blackmail, etc.) this is useless.

If the attacker does not, you'll simply ask for help as soon as you're there.

If the attacker wants to impersonate you, a photo check will work as well and is much faster

The authors and the news coverage claim this offers some sort of rubber-hose defense but the only scenarios described are either contrived or duplicate more proven techniques (e.g. duress codes, biometrics)

They would just threaten with torture unless you play the "passgame", just like they make you enter your password.

I think one advantage would be that they can force you to enter it… but only you. They can't get the password and kill you afterwards:)

Yeah, it's not described too well in the article but I think there are some users for this.

Have you play it and record your performance. Now they can spoof the game with a computer player that intentionally mimics your performance.

Simple answer there.... just have the system automatically lock the account if you statistically miss the password, just at it statistacally allows you in if you play properly.

Or maybe it's only accessible from secure locations - you don't go this much trouble to secure day to day stuff.

It's not unbreakable, but the idea that you're letting someone in by statistical analysis of their conditioned response to a game, including their mistakes is clever - no reason you couldn't lock them out or use other security measures by failure to meet that response.

My first thought was "how would locking the account if you miss it help, if you don't know how to miss it?"

However, if you're in a situation where someone is trying to forcibly extract access from you, there's s good chance that a stressed state of mind would be reflected in variations in how you play, which could be noticed by the system.

Even if it's limited to a specific secured location, though, you still have to worry about the possibility of keyloggers, which could be used to mount a reply attack without you ever having to know.

If you don't like the article, flag it and move on. Meta discussions (particularly about voting conspiracy theories) are not interesting.

The deniability aspect is irrelevant. This is a method of authentication, not encryption. For the authentication to work, the system must know the password and present it to you, along with two other non-password foils. Then to access the system you must demonstrably show that you "score higher" on the trained sequence.

I'm not sure how one would apply this method to encryption.

> Mrs Ebastian's

more likely Mr Sebastian ... or was that intentional?

I've always liked that about my name -- it has a certain amount of ambiguity.

(It is Mr Seb though. Today, anyway.)