Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I had the idea of converting map locations into passwords. Basically Jumblar takes a hash of the user's location and stores this as a comment on the PGP network. The 'stored-hash'(Vague-Hash) currently is only 2-bytes long. Each time the user wishes to use that location to generate passwords, they will first attempt supply a guess location. Jumblar then spirals around this guess location until it finds the point with the same hash.

Jumblar then uses this location as the basis for password generation. The user will add a 'spice' e.g username@email.com that Jumblar will use to generate a password. So rather than the user remembering a map location for each password, they only need to remember one location and a list of spices. Currently I'm assuming that is fine to store the spice(s) in open storage. So long as the map location remains a secret, the passwords derived from the spice(s) are 'safe'.

When Jumblar generates a password there is a guarantee that it will contain atleast - one lowercase, one uppercase and one numeric - character.

Vague Hash

Jumblar only does a vague-hash of the secret location. Rather than storing the entire location hash on the PGP network, Jumblar only stores between 2-3 bytes of hash material. So a potential cracker could only discover a set of possible points that correspond to the vague-hash. The vague-hash is only used to distinguish the secret location from immediately surrounding locations. If the user guesses a location far away from the actual location, then Jumblar is likely to match an incorrect location.

A review and/or comments of the 'idea' and even the project would be greatly appreciated.

Salt & Master Password

The user must also remember a 'master' password and a salt accompanies each vague-hash. So the vague-hash is a result of hashing upon the secret location, password and salt.

share|improve this question
1  
The entropy contained in a single location is pretty low, so the generated password might be weak. –  CodesInChaos Jul 19 '13 at 7:30
1  
Especially with the hash of the location being available (stored as a comment on the PGP network, see first sentence), exhaustive search of the location is going to be quite easy (do the search spiraling away from the user's home for improved efficiency). Once you have that, guess the "spice" and recover the password. –  minar Jul 19 '13 at 7:51
    
Thanks, I should have mentioned that the stored hash is only 2-bytes long. So an attacker would only know a set of suitable locations. The intention of the stored hash is to only store enough information to distinguish the 'secret location' from surrounding locations. –  Kurent Jul 19 '13 at 7:56
1  
Your "vague hash" should be replaced with a secure sketch. $\:$ –  Ricky Demer Jul 19 '13 at 8:31
3  
I don't know. If I don't know the location then I'm not that likely to remember it. If I do choose a known location then there is a big chance that an attacker would guess the right location. Many people are really bad at reading maps too. Seems to me that this is only good for thwarting attacks from geographically challenged attackers. –  owlstead Jul 19 '13 at 14:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.