Hackaday Links: October 27, 2024

Hackaday Links Column Banner

Problem solved? If the problem is supplying enough lithium to build batteries for all the electric vehicles that will be needed by 2030, then a new lithium deposit in Arkansas …read more Continue reading Hackaday Links: October 27, 2024

Security of a non-random password but that relies on information an attacker cannot possibly know

I am trying to figure out whether a non-random password that relies on information an attacker cannot possibly know can be secure.

To give an example, let’s say that I generate my password by putting together the surnames of the first 5 people that I ever fancied. Let’s also assume that there is nobody in the world who knows those names apart from me. I can think of reasons for why this password can be considered both insecure and secure, and I am unable to determine which one is correct.

Reasons it might be insecure:

  1. The password entropy associated with this method for generating the password is 0. It is completely deterministic.
  2. All discussions I found on password security center around entropy, so this should be considered a weak password based on its entropy of 0.

Reasons it might be secure:

  1. The information required for generating a password using this method cannot be known by a potential attacker.
  2. The best an attacker can do is somehow figure out my method. Even then, the “word list” of all possible surnames would contain thousands of words, so perhaps the entropy should not be considered as 0 in practice?
  3. While it sounds like security by obscurity, I believe that it might not be, because this is a case where an attacker cannot possibly get to know the surnames.
  4. And all of this is assuming that the attacker can somehow figure out my method of generating the password, which they have no way of figuring it.

I went through lots of great questions on here regarding password entropy:

  1. XKCD #936: Short complex password, or long dictionary passphrase?
  2. Is “the oft-cited XKCD scheme […] no longer good advice”?
  3. Why are passwords generated by a password generator a complicated mix of letters and numbers instead of a long phrase?
  4. Should passwords be truly random?
  5. What does “random” mean in the context of password creation?
  6. Confused about (password) entropy
  7. Why use entropy at all in considering password strength?
  8. How secure is Snowden’s MargaretThatcheris110%SEXY password?

However, I am still unable to find the answer.

Continue reading Security of a non-random password but that relies on information an attacker cannot possibly know

Why does Bluetooth Low Energy Secure Connections with Passkey Entry check the Passkey bit by bit?

If we want to enable an authenticated connection via BLE the passkey method seems like a good idea. A 6-digit PIN is generated randomly on one device and has to be entered on the other – these 20 Bit of entropy should be a reasonable count… Continue reading Why does Bluetooth Low Energy Secure Connections with Passkey Entry check the Passkey bit by bit?

Is there any good way of calculating a brain-generated password’s entropy?

After reading this post, I understand that a password’s entropy depends on the assumptions made when it is to be attacked (e.g. if it is generated randomly from a list of 2048 words, etc.).
Let’s suppose an attacker managed to enter some u… Continue reading Is there any good way of calculating a brain-generated password’s entropy?