1
$\begingroup$

Please bear with me on this, I'm not learnt in this field, just trying to ask questions about the security of my encryption method.

I'm trying to create a mentally computable human password manager method that can generate strong passwords using a set of operations and a master password, so that you only have to really remember one password to have strong passwords for all your accounts. And also to never have to change the system in your life so you can have backwards compatibility. The system will work even when everything has been exposed to a public. My desire is to have the system be intuitive and user friendly (instead of having to put effort into memorizing 1pad charts, etc.) yet secure.

I had some feedback elsewhere that my system outputs strong passwords against normal attacks but is vulnerable to a determined adversary, so now I made some changes.

For the sake of simplicity, I will be using weak passwords, but bear in mind it doesn't take that much to obfuscate the final output with scrambling, numbers and symbols.

So, I have a string of 34 letters, each letter representing a word that starts with said letter. That is my master password.

Let's begin with making a Google account:

1. Google

First, I take the word Google to apply the seed G = 7th letter of the alphabet (position) Google = 6 letters (length)

2. GoogleLydngr

Then, I add the 6 (length) letters after the 7th (position) letter of the master password

3. GoogleLydAroundngr

At this point, the last letter "r", represents a word which has 3 letters I move back 3 spaces and add the word "Around", which is the next letter/word after the "r"

GoogleLydAroundngr

So that will be my password for Google. This example is easily bruteforced but my question isn't about the password strength but more of the concept.

Now I create a Facebook account, using the same system:

FacebookGlAndydngra (6 position, 8 length)

You will notice the difference is the letters and number of letters, and that I moved back 6 spaces instead of 3, and has added "And" instead of "Around".

I create 3 more for Instagram, Twitter and Microsoft:

InstagramDngrNeveraadyn (9 position, 9 length)

TwitterNgraNeverady (20 position = 0 = 10 position, 7 length)

MicrosoftYungRunlydng (13 position = 3, 9 length)

So, you hacked my accounts through a keylogger, and got a hold of all my passwords. Also, you discover my order of operations. And finally, I wrote down my master password in a text file, so you know that too. I lose everything.

But I go ahead and create new accounts using the same system. However, I change the master password.

How easy is it to crack my new accounts just based on the fact you know everything now... except for my new master password?

For anyone who's curious, the master password is Nggyunglydngraadyngmycngsgngtalahy

Never gonna give you up

Never gonna let you down

Never gonna run around and desert you

Never gonna make you cry

Never gonna say goodbye

Never gonna tell a lie and hurt you

But seriously, this is a serious question. I'm trying to use the chaos of language and musical timing to generate more variety in place of complex calculations. But I'm not smart or educated in this field to know how flawed my system is.

And just another tidbit, one song alone can generate several passwords for when I need to change a single password exclusively, all I have to do is use a different verse of the song or use syllables instead, or something.

Thanks and appreciate any help or comment given.

Improve this question
$\endgroup$
5
  • $\begingroup$ xkcd.com/936 $\endgroup$
    – kelalaka
    Dec 13, 2020 at 23:11
  • $\begingroup$ is that just talking about my password strength? because i've stated it's weak password to keep my narrative simple $\endgroup$
    – towardshumanintuitivepasswords
    Dec 13, 2020 at 23:20
  • 1
    $\begingroup$ What is the advantage of your proposed system over using a conventional password manager that is more secure, and doesn't require changing all passwords in the event of a data breach? $\endgroup$
    – Modal Nest
    Dec 13, 2020 at 23:28
  • $\begingroup$ Personally, it's one more thing to install and manage, manually adding accounts everytime you register for something. And I just don't trust anything outside of my own control. Not to mention putting all of such importance in one external basket. Also, being unable to use it to sign in conveniently on devices that arn't mine. Or casually share passwords and accounts with others without excluding the account from system (which my method handles somewhat). There's much more. In any case, why wouldn't a password manager need to change all passwords when breach? These are all offtopic however. $\endgroup$
    – towardshumanintuitivepasswords
    Dec 13, 2020 at 23:46
  • $\begingroup$ P.S. You need to tag people in order for them to be informed of your comment. I.e. @username. I will answer. $\endgroup$
    – Modal Nest
    Dec 14, 2020 at 11:49

1 Answer 1

Reset to default
2
$\begingroup$

Firstly, you shouldn't really invent your own password manager, except for fun/experimentation/learning purposes. Especially if you are a beginner.

Regarding your comments, I don't really see how managing your own in your head can be less hassle than managing a standard one on a machine. I use google/chrome's (BOO!) so can use across devices and could give away passwords to certain accounts, for whatever reason.

You may find this interesting reading. It seems very similar to your idea. It uses a pin as well as a cue for each site. It also goes into detail about the reduction in security as you use the system to "generate" more passwords.

Your scheme gives away bits of the master key in each password, and has virtually no real entropy. There is a 23.5% chance the letters in your passwords will be 'g'.

If we change the lyrics to something tasteful like the opening verse of Dylan's Subterranean homesick blues, we still have 0% chance of a 'z'.

There are 256 possible values in a random byte.

Imagine another scheme I invent which uses a cryptographically secure salted hash, where the salt is the website address/master key/time added to database, and the input to the hash is the master key. My master key is "never gonna give you".

  • Each of my website passwords might be anything. They are not all based on the letters in my master key.
  • If websiteX password is breached, it gives an attacker nothing about the password for websiteY, or the master key.
  • When I change my password for websiteX, I don't need to change my master key.
  • The basic security of my system relies on a cryptographically secure hash that wasn't designed by me.

Obviously (as mentioned) I wouldn't use my own scheme because there are already better existing schemes designed (and implemented) by people who know better.

Improve this answer
$\endgroup$
1
  • $\begingroup$ To add to this, stateless password management schemes (the "derive everything from master password + domain" sorts of things instead of "store an encrypted database of account info + password") are inherently bad, because when (not if) you have to change your password for one site you either have to either change it for every site or start storing state (like a counter of how many times each site has been changed). Just use Keepass or Bitwarden or similar. $\endgroup$
    – SAI Peregrinus
    Dec 14, 2020 at 15:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.